Authorization Bypass Vulnerability in Praisonai-Platform: Cross-Tenant Integrity Violation
Summary
GHSA-2fjj-qqg8-fg7x: praisonai-platform: Authorization Bypass Through User-Controlled Key. Affects praisonai-platform versions < 0.1.8. Fixed in 0.1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Praisonai-platform is an open-source project management tool that allows users to create and manage issues within specific workspaces. It is designed to facilitate collaboration among team members by organizing tasks and tracking project progress. However, the platform has a vulnerability that allows unauthorized users to manipulate project statistics by referencing projects from other workspaces, leading to potential data integrity issues.
Vulnerability Detail
The vulnerability arises from the create and update endpoints in the Praisonai-platform, which accept a project_id in the request body without validating that the project belongs to the specified workspace. This allows a user from one workspace to create issues that reference projects from another workspace, resulting in unauthorized access to project statistics. Specifically, the ProjectService.get_stats() function aggregates issues by project_id without any workspace constraints, allowing cross-tenant data pollution. This issue is distinct from previously fixed path-parameter IDOR vulnerabilities, as it involves object references supplied in the request body during write operations.
How To Fix
Latest published version: 0.1.9 as of 22 Oct 2026
pip install --upgrade "praisonai-platform==0.1.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.8
This is the first release that contains the fix.
pip install --upgrade "praisonai-platform==0.1.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the project_id in your application logic before making requests to the create and update endpoints. Ensure that the project_id belongs to the workspace_id specified in the URL. Example code for validation:
if body.project_id is not None: project = await ProjectService(session).get(body.project_id, workspace_id=workspace_id) if project is None: raise HTTPException(404, 'Project not found')
Conclusion
The Praisonai-platform has a significant vulnerability that allows unauthorized users to manipulate project statistics across workspaces. It is crucial to update to the latest version to mitigate this risk. Additionally, implementing manual validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for praisonai-platform →
FAQ
An unauthorized user can manipulate project statistics by creating issues that reference projects from other workspaces, leading to inflated or skewed data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Yes, the vulnerability has been patched in version 0.1.8 of the Praisonai-platform. It is recommended to update to this version.
If an immediate update is not possible, implement manual validation of project_id against workspace_id in your application logic as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for praisonai-platform.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
