CVE-2026-58653: PraisonAI Cross-Tenant Authorization Bypass in Issue Management

Technical summary

The vulnerability stems from insufficient authorization validation in the issue creation and update endpoints. PraisonAI fails to verify that the project_id supplied in the request body belongs to the workspace identified in the URL path. An authenticated attacker in workspace A can craft a request to create or update an issue, specifying a project_id from workspace B. The application processes this request without cross-tenant constraint validation, resulting in unauthorized project modifications and aggregation of statistics across workspace boundaries. The flaw is classified as an authorization bypass (CWE-639) affecting data integrity.

Business impact

For multi-tenant SaaS deployments of PraisonAI, this vulnerability enables subtle sabotage of project metrics and reporting without detection. Attackers can inflate issue counts, artificially modify project health indicators, or corrupt audit trails by injecting cross-tenant records. In environments where project statistics drive business decisions, allocate resources, or inform compliance reporting, such pollution introduces unreliable data. Enterprises relying on PraisonAI for project governance may make incorrect decisions based on compromised metrics. The attack requires authentication but no additional privileges, making it a concern in environments with many tenant users.

Affected systems

PraisonAI versions before 0.1.7 are vulnerable. The issue affects all deployments where multi-workspace isolation is expected (i.e., any multi-tenant configuration). Single-workspace or non-production deployments may have reduced exposure. The vulnerability is present in both issue creation and issue update operations.

Exploitability

The CVSS 3.1 score of 4.3 (MEDIUM) reflects low to moderate real-world risk. Exploitation requires valid authentication (PR:L), network access (AV:N), and no user interaction (UI:N). An attacker must possess valid credentials to any workspace. The attack surface is limited by requiring knowledge of valid project IDs in other workspaces, though enumeration is often straightforward in multi-tenant environments. The impact is integrity-only (data corruption, not confidentiality loss), which moderates severity. This is not a zero-click or zero-auth flaw.

Remediation

Upgrade PraisonAI to version 0.1.7 or later, which introduces server-side validation ensuring that the project_id in issue requests belongs to the workspace specified in the URL. After patching, verify that cross-workspace issue creation is rejected with an appropriate authorization error. Organizations should also review access logs and project statistics for evidence of cross-tenant pollution prior to the patch date.

Patch guidance

Apply the 0.1.7 update immediately across all PraisonAI deployments. The patch adds authorization checks to both issue creation and update endpoints. Coordinate the upgrade during a maintenance window to minimize disruption. Test in a staging environment first to confirm that existing legitimate workflows are not impacted by the stricter validation. Rollback procedures should be documented in case of unexpected issues, though the patch is considered safe for production. Verify the patch has been applied by confirming the installed version matches 0.1.7 or higher.

Detection guidance

Monitor for suspicious patterns in issue creation and update logs: look for requests where the workspace ID in the URL does not match the workspace ID of the target project, or where project_id references outside the user's known workspace portfolio. Implement audit logging on the issue creation and update endpoints to record both the requested project_id and the actual project affected. Search historical logs for mismatches between workspace boundaries and project assignments. Cross-reference project statistics with user access logs to identify anomalous spikes in issue counts from unexpected tenant sources. Organizations using centralized security logging should flag authorization validation failures on these endpoints.

Why prioritize this

While the CVSS score is moderate (4.3), this vulnerability merits prompt attention because it directly undermines data integrity in a multi-tenant environment, a foundational trust assumption. Unlike confidentiality breaches, integrity attacks are often silent and may go undetected for extended periods. In SaaS platforms, tenant isolation is non-negotiable; any flaw that breaks this boundary, even in a limited way, signals a gap in security architecture that could indicate related issues. The fix is simple and low-risk, making timely patching a pragmatic investment. Organizations should prioritize this above similarly-scored vulnerabilities that affect single-tenant systems or have higher exploitation friction.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network-accessible endpoint requiring authentication, reducing base severity; (2) Low complexity attack requiring only parameter manipulation; (3) Integrity impact (data pollution) but no confidentiality or availability loss; (4) Unchanged security scope (single-tenant isolation, not system-wide). The score is proportional to the threat—real but not catastrophic—and appropriate for a data integrity issue in a controlled authentication context.

Frequently asked questions