https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 06:30:49 +0000 https://cve.radiocsirt.org/vuln/cve-2026-47416 <p><strong>Affected:</strong> MervinPraison praisonai-platform</p> <p>PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `require_workspace_member(workspace_id)`, which defaults to `min_role=&#34;member&#34;` and is never overridden by the route. The handler then calls `MemberService.update_role(workspace_id, user_id, body.role)` which sets the target member&#39;s role to whatever the request body specifies, with no check that the caller has owner-or-admin privilege, no check that the new role is not higher than the caller&#39;s own, and no check that the caller is not silently promoting themselves. PraisonAI Platform version 0.1.4 patches the issue.</p> <p><strong>Affected:</strong> MervinPraison praisonai-platform</p> <p>PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `require_workspace_member(workspace_id)`, which defaults to `min_role=&#34;member&#34;` and is never overridden by the route. The handler then calls `MemberService.update_role(workspace_id, user_id, body.role)` which sets the target member&#39;s role to whatever the request body specifies, with no check that the caller has owner-or-admin privilege, no check that the new role is not higher than the caller&#39;s own, and no check that the caller is not silently promoting themselves. PraisonAI Platform version 0.1.4 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-47416