CVE-2026-61440
CVE-2026-61440 · PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
praisonai
- Versions
- ≥ 0, < 0.1.9: Affected (semver)
- 0.1.9: Not affected (semver)
Update to 0.1.9
praisonai-platform PyPI
- Versions
- 0.1.0
- 0.1.1
- 0.1.2
- 0.1.3
- 0.1.4
- 0.1.6
- 0.1.8
- Affected ranges
- ECOSYSTEM: < 0.1.9
Update to 0.1.9
Original sources
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xxgv-vgvj-qvxh
- https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753
- https://www.vulncheck.com/advisories/praisonai-platform-before-authorization-bypass-via-label-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-61440