CVE-2026-61440: PraisonAI Platform Members Can Unauthorizedly Modify Shared Labels
Summary
CVE-2026-61440: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization Summary praisonai-platform lets an ordinary workspace member rename and recolor shared labels and add/remove labels on a... Affects praisonai-platform versions < 0.1.9. Fixed in 0.1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PraisonAI is an open-source platform designed for collaborative project management, allowing users to manage issues, labels, and workflows within shared workspaces. It provides features for tracking tasks, assigning labels, and managing project states. However, a recent vulnerability has been identified that allows ordinary workspace members to alter shared labels and issue labels without proper authorization, undermining the integrity of the project management process.
Vulnerability Detail
The vulnerability arises from insufficient authorization checks in the PraisonAI platform's API routes. Specifically, ordinary workspace members can rename and recolor shared labels and add or remove labels from owner-created issues, despite the fact that label deletion is restricted to workspace admins or owners. This issue stems from the API's reliance on workspace membership for label modifications, rather than enforcing stricter ownership checks. The consequences of this vulnerability include potential manipulation of label meanings, disruption of issue tracking, and loss of control over project workflows.
How To Fix
Latest published version: 0.1.9 as of 22 Oct 2026
pip install --upgrade "praisonai-platform==0.1.9"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, workspace owners can monitor label changes closely and revert unauthorized modifications manually until the patch is applied. Additionally, restricting member access to label management features can help mitigate the risk.
Conclusion
The PraisonAI platform has a significant vulnerability (CVE-2026-61440) that allows unauthorized modifications to shared labels and issue labels by ordinary members. It is crucial for users to update to the latest version to mitigate this risk and maintain the integrity of their project management processes.
See every vulnerability recorded for praisonai-platform →
FAQ
CVE-2026-61440 is a vulnerability in the PraisonAI platform that allows ordinary workspace members to modify shared labels and issue labels without proper authorization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized changes in label meanings, disruption of issue tracking, and loss of control over project workflows, impacting the integrity of project management.
You can update the PraisonAI platform to the patched version by running the command: 'pip install --upgrade praisonai-platform'.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for praisonai-platform.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
