CVE-2026-61442 Details
Description
PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check.
A vulnerability exists in PraisonAI Platform versions prior to 0.1.9, where the application fails to properly enforce authorization for workspace members on PATCH routes related to projects, issues, and agents. This oversight allows a workspace member to modify records created by the owner, bypassing intended permission checks. For instance, a member can reassign the project lead to their own user ID and subsequently delete the project, exploiting a gap in the authorization process.
Users are advised to update to PraisonAI Platform version 0.1.9 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 11, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c78w-2q4r-68r7 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753 | [email protected] | Source CodeVendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c78w-2q4r-68r7 | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/praisonai-platform-before-authorization-bypass-via-patch | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PraisonAI Platform | <= 0.1.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 11, 2026 | New CVE Received | [email protected] |