PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The "PATCH /workspaces/{workspace_id}" endpoint is gated only by "require_workspace_member(workspace_id)" (default "min_role="member""). Any member can rewrite the workspace's "name", "description", and the "settings" JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue.