CVE-2026-61441: PraisonAI Platform - Unauthorized Deletion of Owner Issue Dependencies by Members
Summary
CVE-2026-61441: PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues. Affects praisonai-platform versions < 0.1.9. Fixed in 0.1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PraisonAI is an open-source platform designed for collaborative project management, enabling users to create and manage issues within workspaces. It allows for the establishment of dependencies between issues to maintain workflow integrity. However, a vulnerability exists that permits ordinary workspace members to delete dependencies associated with owner-created issues, undermining the intended access controls.
Vulnerability Detail
The vulnerability arises from improper authorization checks in the dependency deletion endpoint of the PraisonAI platform. Specifically, a workspace member can delete an issue dependency that is owned by another user by exploiting the ability to select the URL of a member-owned related issue. This bypasses the intended permission checks, allowing unauthorized modifications to the workflow state of owner-created issues. The technical flaw lies in the endpoint's design, which does not adequately enforce ownership restrictions when deleting dependencies, leading to potential disruptions in project management and workflow integrity.
How To Fix
Latest published version: 0.1.9 as of 22 Oct 2026
pip install --upgrade "praisonai-platform==0.1.9"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, workspace owners can monitor and review dependencies regularly to ensure that unauthorized deletions do not occur. Additionally, restricting member permissions until the package is updated can help mitigate the risk.
Conclusion
CVE-2026-61441 represents a significant security concern for users of the PraisonAI platform, allowing unauthorized deletion of issue dependencies by ordinary members. It is crucial for users to update to the latest version to mitigate this risk and maintain the integrity of their project workflows.
See every vulnerability recorded for praisonai-platform →
FAQ
CVE-2026-61441 is a vulnerability in the PraisonAI platform that allows ordinary workspace members to delete dependencies from owner-created issues, bypassing intended authorization checks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized changes in project workflows, potentially disrupting project management and causing loss of critical dependency relationships.
The vulnerability has a CVSS score of 6.5, indicating a medium severity level that requires attention to prevent unauthorized access and modifications.
If immediate updates are not possible, consider implementing stricter access controls and monitoring dependency changes closely until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for praisonai-platform.
