CVE-2026-61441

MEDIUM 6.5

PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a dependency through an owner-created issue endpoint (which returns 403) can delete the same dependency edge by targeting a related member-owned issue endpoint, because permission is validated against the member-owned issue's owner. This allows members to bypass owner/admin authorization and remove owner-created issue dependencies.

CWE	CWE-862
Vendor	mervinpraison
Product	praisonai
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for mervinpraison praisonai

Be the first to know when new medium vulnerabilities affecting mervinpraison praisonai are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

MervinPraison / PraisonAI

0 < 0.1.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-mxmx-rh57-jx58 github.com: https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753 vulncheck.com: https://www.vulncheck.com/advisories/praisonai-platform-before-authorization-bypass-via-dependencies

Credits

🔍 rexpository