CVE-2026-61441 Details

An authorization bypass vulnerability has been identified in the PraisonAI Platform prior to version 0.1.9, allowing workspace members to delete issue dependencies from owner-created issues by exploiting the dependency management system. The vulnerability arises because the DELETE dependency route improperly authorizes deletion requests. It accepts either endpoint of a dependency edge but only checks permissions against the issue selected by the caller. As a result, a member who is denied permission to delete a dependency through an owner-created issue can successfully remove the same dependency by targeting a related member-owned issue. This bypasses the intended owner/admin authorization and disrupts the management of issue dependencies.

To address this vulnerability, it is recommended to implement a more robust authorization mechanism for dependency management. This could involve requiring explicit owner or admin permissions for deletion requests, regardless of which issue endpoint is used.