p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in praisonai-platform · Seite 2

In den letzten 30 Tagen veröffentlichte Sicherheitslücke für praisonai-platform: 1. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 24

  1. CVE-2026-61440

    Hoch · CVSS 7.1EPSS 0,26%Korrektur verfügbar

    PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

    PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization.

    praisonai-platformPython
    • Auf 0.1.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-61442

    Hoch · CVSS 7.1EPSS 0,31%Korrektur verfügbar

    PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH

    PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check.

    praisonai-platformPython
    • Auf 0.1.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-61441

    Hoch · CVSS 7.1EPSS 0,29%Korrektur verfügbar

    PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies

    PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a dependency through an owner-created issue endpoint (which returns 403) can delete the same dependency edge by targeting a related member-owned issue endpoint, because permission is validated against the member-owned issue's owner. This allows members to bypass owner/admin authorization and remove owner-created issue dependencies.

    praisonai-platformPython
    • Auf 0.1.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-58653

    Mittel · CVSS 5.3EPSS 0,26%Korrektur verfügbar

    PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update

    PraisonAI before 0.1.7 fails to validate that project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.

    praisonai-platformPython
    • Auf 0.1.8 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →