CVE-2026-61440: PraisonAI Authorization Bypass Vulnerability

CVE-2026-61440 Overview

CVE-2026-61440 is a missing authorization vulnerability [CWE-862] in the PraisonAI Platform before version 0.1.9. The flaw resides in the platform's label and issue-label mutation endpoints, which do not enforce owner or admin authorization checks. Workspace members with standard privileges can rename shared labels, change label colors, and add or remove labels on issues created by workspace owners. Attackers exploit PATCH requests against label endpoints and POST/DELETE requests against issue-label association endpoints to manipulate shared taxonomy and issue metadata without proper authorization.

Critical Impact
Any authenticated workspace member can tamper with shared label taxonomy and modify labels on owner-created issues, undermining workspace integrity and issue tracking accuracy.

Affected Products

PraisonAI Platform versions prior to 0.1.9
MervinPraison/PraisonAI GitHub repository
Deployments using the platform's issue tracking and label management APIs

Discovery Timeline

2026-07-15 - CVE-2026-61440 published to NVD
2026-07-18 - Last updated in NVD database

Technical Details for CVE-2026-61440

Vulnerability Analysis

The PraisonAI Platform exposes REST endpoints for managing labels and issue-label associations within workspaces. The affected endpoints validate that a caller is a member of the target workspace but omit role-based checks that restrict mutation to owners or admins. Any authenticated workspace member can therefore invoke label mutation operations. The impact is scoped to integrity of shared workspace metadata rather than confidentiality or availability, which aligns with the CVSS integrity-only vector.

Root Cause

The root cause is missing authorization logic in the label and issue-label route handlers. The handlers relied on require_workspace_member for gating access but did not additionally verify ownership of the target resource or elevated role membership. The patch introduces a new validate_issue_refs_in_workspace dependency in src/praisonai-platform/praisonai_platform/api/deps.py and applies stricter reference validation across issue routes.

Attack Vector

An attacker with low-privilege workspace member credentials sends authenticated PATCH requests to label mutation endpoints to rename or recolor shared labels. The same actor issues POST or DELETE requests against issue-label association endpoints to attach or detach labels on issues owned by workspace administrators. No user interaction is required and exploitation occurs over the network against any reachable PraisonAI Platform deployment.

python

# Patch excerpt: src/praisonai-platform/praisonai_platform/api/deps.py
async def validate_issue_refs_in_workspace(
    workspace_id: str,
    session: AsyncSession,
    *,
    project_id: Optional[str] = None,
    parent_issue_id: Optional[str] = None,
    assignee_type: Optional[str] = None,
    assignee_id: Optional[str] = None,
) -> None:
    """Reject cross-workspace references in issue create/update bodies."""
    from ..services.agent_service import AgentService
    from ..services.issue_service import IssueService
    from ..services.member_service import MemberService
    from ..services.project_service import ProjectService

    if project_id is not None:
        project = await ProjectService(session).get(project_id, workspace_id=workspace_id)
        if project is None:
            raise HTTPException(
                status_code=status.HTTP_404_NOT_FOUND,
                detail="Project not found",
            )

Source: PraisonAI GitHub Commit 846568c

Detection Methods for CVE-2026-61440

Indicators of Compromise

Unexpected PATCH requests to label endpoints originating from non-admin workspace member accounts.
Sudden bulk changes to label names or colors across shared workspace taxonomy.
POST or DELETE calls to issue-label association endpoints targeting issues owned by other users.
Audit log entries showing label modifications performed by accounts without owner or admin roles.

Detection Strategies

Enable request-level audit logging on all label and issue-label API routes to capture the acting user, role, and target resource.
Baseline typical label mutation volume per workspace and alert on anomalous spikes tied to member-role accounts.
Correlate label change events with the resource owner to flag modifications performed by non-owners.

Monitoring Recommendations

Forward PraisonAI Platform application logs to a centralized logging or SIEM solution for retention and correlation.
Track authentication events alongside label mutation traffic to identify compromised member accounts.
Monitor deployment version metadata to confirm all instances run PraisonAI Platform 0.1.9 or later.

How to Mitigate CVE-2026-61440

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.9 or later, which contains the authorization fix in commit 846568c7.
Audit workspace label history for unauthorized renames, recoloring, or label associations added by non-admin members.
Review workspace membership rosters and revoke member access for any accounts that are no longer needed.

Patch Information

The fix is delivered in PraisonAI Platform 0.1.9. Refer to the GitHub Security Advisory GHSA-xxgv-vgvj-qvxh, the upstream patch commit, and the VulnCheck Advisory on PraisonAI for full remediation guidance.

Workarounds

Restrict PraisonAI Platform API exposure to trusted networks until the upgrade is applied.
Reduce membership in sensitive workspaces to only trusted users while running vulnerable versions.
Place a reverse proxy or API gateway in front of the platform to block PATCH, POST, and DELETE requests to label endpoints from non-admin identities.

bash

# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai-platform>=0.1.9"

# Verify the installed version
python -c "import praisonai_platform; print(praisonai_platform.__version__)"