PT-2026-55200 · Praisonai · Praisonai

Sai-Sh · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-58653

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

PraisonAI before 0.1.7 fails to validate that project id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-58653

Affected Products

Praisonai

References · 3

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2fjj-qqg8-fg7x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58653 · Security Note
• https://vulncheck.com/advisories/praisonai-authorization-bypass-via-unvalidated-project-id-in-issue-create-update · Note