Owner Resource Rewrite and Project Lead Reassignment Bypass in PraisonAI Platform
Summary
GHSA-f996-h3c6-gcwg: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c78w-2q4r-68r7. Affects praisonai-platform versions < 0.1.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PraisonAI Platform is an open-source project management tool designed to facilitate collaboration and organization within teams. It allows users to manage projects, issues, and agents effectively. However, prior to version 0.1.9, the platform had a significant security flaw that allowed workspace members to manipulate owner-created records without proper authorization, leading to potential data integrity issues.
Vulnerability Detail
The vulnerability arises from inadequate authorization checks on the PATCH routes for projects, issues, and agents within the PraisonAI Platform. Specifically, the platform only requires a workspace-member role for these actions, allowing any member to modify records created by the owner. This includes the ability to change the project lead to their own user ID and subsequently delete the project, bypassing the necessary owner/admin permission checks. The ramifications of this flaw can lead to unauthorized access and manipulation of critical project data, undermining the integrity of the platform.
How To Fix
No fixed version is published for this vulnerability.
To rectify this vulnerability, it is essential to update the PraisonAI Platform to version 0.1.9 or later, where the authorization checks have been properly implemented. You can update the package using the following command: pip install --upgrade praisonai-platform. This will ensure that the necessary permissions are enforced, preventing unauthorized modifications.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict workspace member access to sensitive PATCH routes until the platform is updated. This can be done by modifying the access controls in your project settings to limit permissions for non-admin users.
Conclusion
The PraisonAI Platform has a critical vulnerability that allows unauthorized modifications to owner-created records due to insufficient authorization checks. It is crucial to update to version 0.1.9 or later to mitigate this risk. Users should also consider temporary workarounds to enhance security until the update is applied.
See every vulnerability recorded for praisonai-platform →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include unauthorized access to modify or delete projects, leading to data loss and integrity issues within the platform.
Yes, the vulnerability has been patched in version 0.1.9 of the PraisonAI Platform. It is recommended to update to this version.
If you cannot update immediately, consider implementing stricter access controls to limit workspace member permissions until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for praisonai-platform.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.