HIGH 7.1 GitHub
CVE-2026-61442
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
## Summary
`praisonai-platform` lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For projects, the member can first patch `lead_id` to their own user id and then delete the owner-created project, bypassing a delete guard that correctly returned `403` before the reassignment.
## Te
Affected Products
- pip/praisonai-platform <= 0.1.8
References
- https://github.com/advisories/GHSA-c78w-2q4r-68r7
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c78w-2q4r-68r7
- https://nvd.nist.gov/vuln/detail/CVE-2026-61442
- https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-08 via GitHub. Affected: pip/praisonai-platform <= 0.1.8.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.