PT-2026-61775 · Praisonai · Praisonai

CVE-2026-57121 · Published 2026-06-18 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Praison.ai (affected versions not specified)

Description An improper authorization issue allows a workspace member to permanently delete resources created by the workspace owner or other members. While the system verifies workspace membership, it fails to perform ownership or role checks during deletion requests. This allows a user with the member role to irreversibly wipe projects, agents, issues, labels, issue dependencies, and issue-label attachments.

Confirmed vulnerable endpoints include:

• 'DELETE /api/v1/workspaces/{workspace id}/projects/{project id}'
• 'DELETE /api/v1/workspaces/{workspace id}/agents/{agent id}'
• 'DELETE /api/v1/workspaces/{workspace id}/issues/{issue id}'
• 'DELETE /api/v1/workspaces/{workspace id}/labels/{label id}'
• 'DELETE /api/v1/workspaces/{workspace id}/issues/{issue id}/dependencies/{dep id}'
• 'DELETE /api/v1/workspaces/{workspace id}/issues/{issue id}/labels/{label id}'

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-57121

GHSA-RH39-9C67-59MH

PYSEC-2026-3526

Affected Products

Praisonai

References · 7

• https://osv.dev/vulnerability/PYSEC-2026-3526 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rh39-9c67-59mh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-57121 · Security Note
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh · Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://pypi.org/project/praisonai-platform · Note
• https://github.com/advisories/GHSA-rh39-9c67-59mh · Note