CVE-2026-61441: PraisonAI Platform Authorization Bypass in Dependency Deletion

Technical summary

The DELETE dependency endpoint in PraisonAI Platform implements incomplete authorization logic. When a user requests deletion of a dependency edge between two issues, the application validates delete permission only against the caller-selected URL issue endpoint. An attacker with workspace member privileges can exploit this by identifying a dependency they cannot directly delete through the owner-created issue (which correctly returns 403), then resubmitting the same delete request targeting the member-owned issue endpoint of the dependency pair. Because authorization checks the permission context only against the member-owned issue, the permission check passes and the dependency is removed. This represents a classic broken authorization flaw where bilateral relationship integrity is not enforced bidirectionally.

Business impact

Workspace integrity and process governance are undermined. Issue dependencies often represent critical workflow relationships—blocking dependencies, related work, or prerequisite tasks. Members can silently sever these links without detection, disrupting project planning, task sequencing, and ownership accountability. For teams relying on PraisonAI for project coordination, this means lower-privileged members can disrupt carefully managed issue hierarchies that owners intended to control, potentially causing confusion, missed handoffs, or untracked work fragmentation.

Affected systems

PraisonAI Platform versions 0.1.8 and earlier are affected. The vulnerability resides in the dependency deletion authorization logic and impacts any workspace instance using these versions. All workspace members with any issue ownership capability can exploit this against dependencies tied to issues they control.

Exploitability

Exploitability is straightforward and requires only valid workspace member credentials—no elevated access, no network manipulation, and no user interaction. An attacker simply needs to identify a dependency they wish to delete, locate the corresponding issue they own on either end of that dependency, and submit a DELETE request targeting that member-owned issue endpoint. This can be done repeatedly and at scale through API calls, making it suitable for both targeted and bulk exploitation.

Remediation

Upgrade PraisonAI Platform to version 0.1.9 or later. The patched version corrects the authorization logic to validate delete permissions against both endpoints of a dependency edge, preventing lower-privileged users from deleting dependencies regardless of which endpoint they own or control.

Patch guidance

Update to PraisonAI Platform 0.1.9 or a newer version released after 2026-07-10. Verify the patch version in your deployment by checking the platform version indicator and reviewing release notes to confirm the authorization logic for dependency deletion has been updated. If you are unable to upgrade immediately, consider implementing API-level restrictions that require admin approval for dependency deletions in sensitive workflows.

Detection guidance

Monitor DELETE requests to the dependency endpoint for patterns where non-owner users are successfully deleting dependencies tied to issues they own but did not create. Log and alert on 403-to-success sequences where the same dependency deletion is attempted through different issue endpoints. Review workspace audit logs for unexpected dependency removals and cross-reference with user ownership records to identify cases where members deleted dependencies of higher-privileged owner issues.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the practical impact on workspace governance and the ease of exploitation merit prioritization for teams relying on PraisonAI for critical project management. The vulnerability directly undermines administrative control and can be exploited at scale by any workspace member. Organizations using PraisonAI for process-critical work should prioritize this patch in their security update cycle.

Risk score, explained

CVSS 3.1 score of 6.5 reflects a Medium severity rating: the attack requires valid user credentials and network access (PR:L, AV:N), but has no complexity barrier (AC:L), causes high integrity impact (I:H) through unauthorized modification of relationships, with no confidentiality or availability impact (C:N, A:N), and is limited to the affected system (S:U). The score accurately captures the authorization bypass nature of the flaw, though real-world impact may be higher in teams where issue dependencies drive critical workflows.

Frequently asked questions