An authorization bypass vulnerability in the MervinPraison praisonai-platform allows authenticated users to exceed their intended privilege levels and access restricted system functions.

The application suffers from missing authorization (CWE-862) and authorization bypass via user-controlled keys (CWE-639), which can be exploited by an authenticated attacker to manipulate system resources.

With a CVSS score of 8.8, this vulnerability presents a significant risk to data integrity and system control. Authenticated users could potentially escalate their privileges or access sensitive multi-agent configurations, leading to unauthorized data modification or total system compromise.

Immediate Action: Update the praisonai-platform to version 0.1.4 or higher to resolve the authorization flaws.

Proactive Monitoring: Monitor application logs for unusual API calls or actions performed by non-privileged accounts that deviate from standard user behavior.

Compensating Controls: Implement strict role-based access control (RBAC) at the network or application gateway level to limit the exposure of sensitive endpoints to authenticated users only.

Public Exploit Available: Unknown.

Security teams must prioritize updating the PraisonAI platform to the specified fixed version. Ensuring that authorization checks are properly enforced is critical to maintaining the integrity of multi-agent systems and preventing unauthorized administrative control.