PT-2026-57438 · Unknown · Praisonai-Platform

Rexpository · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61442

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions PraisonAI Platform versions prior to 0.1.9

Description The platform fails to enforce owner or administrator authorization on the PATCH routes for projects, issues, and agents, requiring only the workspace-member role. This allows a user with low privileges to modify records created by the workspace owner. Specifically, for projects, a member can reassign the lead id variable to their own user ID and subsequently delete the project, which bypasses the owner or administrator permission check typically required by the delete route.

Recommendations Update to version 0.1.9 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-61442

GHSA-C78W-2Q4R-68R7

Affected Products

Praisonai-Platform

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61442.json · Exploit
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c78w-2q4r-68r7 · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753 · Patch
• https://osv.dev/vulnerability/CVE-2026-61442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61442 · Security Note
• https://twitter.com/CVEnew/status/2075976714014900498 · Twitter Post
• https://twitter.com/infoflowcloud/status/2075977404808413252 · Twitter Post
• https://twitter.com/UpwindMDR/status/2076013801690870230 · Twitter Post
• https://vulncheck.com/advisories/praisonai-platform-before-authorization-bypass-via-patch · Note