PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The "POST /workspaces/{workspace_id}/members" endpoint is gated only by "require_workspace_member(workspace_id)" (default "min_role="member"") and forwards the request body's "user_id" and "role" straight into "MemberService.add(workspace_id, user_id, role)", which has no caller-permission check. A user with the lowest workspace privilege can add any user (including a new attacker-controlled second account, or an existing account they want to grief) as owner of the workspace. PraisonAI Platform version 0.1.4 patches the issue.