https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 23:51:55 +0000 https://db.gcve.eu/vuln/cve-2026-61442 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route&#39;s owner/admin permission check.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route&#39;s owner/admin permission check.</p> https://db.gcve.eu/vuln/cve-2026-61442 https://db.gcve.eu/vuln/pysec-2026-4262 <p><strong>Affected:</strong> PyPI: praisonai-platform</p> <p># Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass</p> <p>## Summary</p> <p>`praisonai-platform` lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For projects, the member can first patch `lead_id` to their own user id and then delete the owner-created project, bypassing a delete guard that correctly returned `403` before the reassignment.</p> <p>## Technical Details</p> <p>The affected boundary is the difference between &#34;is a workspace member&#34; and &#34;owns or administers this resource&#34;. `src/praisonai-platform/praisonai_platform/api/deps.py` defines `require_workspace_member`, `require_workspace_admin`, `require_workspace_owner`, and `require_delete_permission`. `require_workspace_member` only checks that the caller has at least the `member` role in the workspace, while `require_delete_permission` allows delete only for workspace admins/owners or the resource owner.</p> <p>The project update route in `src/praisonai-platform/praisonai_platform/api/routes/projects.py` defines `PATCH /workspaces/{workspace_id}/projects/{project_id}` with `user: AuthIdentity = Depends(require_workspace_member)`. It passes `title`, `description`, `status`, `lead_type`, and `lead_id` into `ProjectService.update`. `src/praisonai-platform/praisonai_platform/services/project_service.py` then writes `project.lead_id = lead_id` when supplied. The paired project delete rout…</p> <p><strong>Affected:</strong> PyPI: praisonai-platform</p> <p># Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass</p> <p>## Summary</p> <p>`praisonai-platform` lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For projects, the member can first patch `lead_id` to their own user id and then delete the owner-created project, bypassing a delete guard that correctly returned `403` before the reassignment.</p> <p>## Technical Details</p> <p>The affected boundary is the difference between &#34;is a workspace member&#34; and &#34;owns or administers this resource&#34;. `src/praisonai-platform/praisonai_platform/api/deps.py` defines `require_workspace_member`, `require_workspace_admin`, `require_workspace_owner`, and `require_delete_permission`. `require_workspace_member` only checks that the caller has at least the `member` role in the workspace, while `require_delete_permission` allows delete only for workspace admins/owners or the resource owner.</p> <p>The project update route in `src/praisonai-platform/praisonai_platform/api/routes/projects.py` defines `PATCH /workspaces/{workspace_id}/projects/{project_id}` with `user: AuthIdentity = Depends(require_workspace_member)`. It passes `title`, `description`, `status`, `lead_type`, and `lead_id` into `ProjectService.update`. `src/praisonai-platform/praisonai_platform/services/project_service.py` then writes `project.lead_id = lead_id` when supplied. The paired project delete rout…</p> https://db.gcve.eu/vuln/pysec-2026-4262