CVE-2026-61440 Details

An authorization bypass vulnerability has been identified in the PraisonAI Platform, specifically in versions prior to 0.1.9. This vulnerability allows workspace members to manipulate shared labels and issue-label associations on owner-created issues without proper authorization. Affected members can rename and recolor shared labels, as well as add or remove labels on issues created by owners. The vulnerability arises from inadequate authorization checks on label and issue-label mutation endpoints, enabling unauthorized modifications to the label taxonomy and issue workflow states.

The vulnerability can be addressed by implementing proper authorization checks for label and issue-label mutations. This includes requiring workspace admin or owner authority for updating shared labels and managing labels on owner-created issues. Regression tests should also be added to ensure that these authorization checks are enforced.