The PraisonAI Platform's PATCH /workspaces/{workspace_id}/members/{user_id} endpoint is protected by a middleware requiring membership with a minimum role of 'member'. However, it lacks checks to ensure the caller has owner or admin privileges before allowing role changes. The MemberService.update_role method sets the target user's role to the requested value without verifying that the caller is authorized to assign that role or that the new role is not higher than the caller's own. This flaw enables vertical privilege escalation. The vulnerability affects all versions prior to 0.1.4, which includes the default minimum role enforcement and the unchecked role update logic. Version 0.1.4 patches this issue.

An attacker with at least member-level access to a workspace can escalate their privileges to owner or admin roles without authorization. This leads to a complete compromise of workspace permissions, allowing unauthorized access to sensitive data and administrative functions. The vulnerability has a high confidentiality and integrity impact but does not affect availability.

Version 0.1.4 of PraisonAI Platform contains a fix for this vulnerability. Users should upgrade to version 0.1.4 or later to remediate the issue. There is no indication of a temporary workaround or alternative mitigation. Patch status is not explicitly stated but the description confirms the issue is fixed in 0.1.4.