CVE-2026-62179 PUBLISHED

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Assigner: GitHub_M
Reserved: 13.07.2026 Published: 07.10.2026 Updated: 07.10.2026

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Product Status

Vendor MervinPraison
Product praisonai-platform
Versions
  • Version < 0.1.9 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE
  • CWE-863: Incorrect Authorization CWE