CVE-2026-61442: PraisonAI Auth Bypass Vulnerability

CVE-2026-61442 Overview

CVE-2026-61442 is a missing authorization vulnerability [CWE-862] in PraisonAI Platform (praisonai-platform) versions prior to 0.1.9. The PATCH routes for projects, issues, and agents only enforce the workspace-member role instead of requiring owner or admin privileges. A workspace member can modify records created by the workspace owner. For projects, a member can reassign lead_id to their own user ID, then delete the owner-created project by bypassing the delete route's owner/admin permission check.

Critical Impact
Authenticated workspace members can tamper with and delete owner-created projects, issues, and agents, undermining tenant integrity in multi-user PraisonAI deployments.

Affected Products

PraisonAI Platform (praisonai-platform) versions before 0.1.9
Projects PATCH route in the platform API
Issues and Agents PATCH routes in the platform API

Discovery Timeline

2026-07-11 - CVE-2026-61442 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61442

Vulnerability Analysis

The flaw resides in the PraisonAI Platform API dependency layer. PATCH endpoints for projects, issues, and agents were guarded only by require_workspace_member, a permission check that admits any authenticated member of the workspace. Owner or admin authorization was not enforced on mutation, allowing lower-privileged members to update resources that they did not create.

The project resource compounds the impact through a logic chain. A member can PATCH a project owned by another user and set lead_id to their own user ID. The delete route checks whether the caller is the owner, admin, or lead. Once the attacker becomes the lead, the delete route grants access and the owner-created project is removed. The pattern qualifies as both an authorization bypass and a business logic flaw.

Root Cause

The root cause is missing authorization on state-changing routes. The permission model conflated workspace membership with the right to modify arbitrary resources. Cross-workspace reference validation on issue create/update bodies was also absent, which the patch addresses by introducing validate_issue_refs_in_workspace.

Attack Vector

An attacker needs valid credentials for a workspace-member account on the target PraisonAI Platform instance. Exploitation is a single authenticated HTTP PATCH request to the projects, issues, or agents endpoint. No user interaction is required, and the attack originates over the network.

python

# Patch excerpt: src/praisonai-platform/praisonai_platform/api/deps.py
    ensure_resource_in_workspace(issue.workspace_id, workspace_id, label="Issue")
    return issue


async def validate_issue_refs_in_workspace(
    workspace_id: str,
    session: AsyncSession,
    *,
    project_id: Optional[str] = None,
    parent_issue_id: Optional[str] = None,
    assignee_type: Optional[str] = None,
    assignee_id: Optional[str] = None,
) -> None:
    """Reject cross-workspace references in issue create/update bodies."""
    from ..services.agent_service import AgentService
    from ..services.issue_service import IssueService
    from ..services.member_service import MemberService
    from ..services.project_service import ProjectService

    if project_id is not None:
        project = await ProjectService(session).get(project_id, workspace_id=workspace_id)
        if project is None:
            raise HTTPException(
                status_code=status.HTTP_404_NOT_FOUND,
                detail="Project not found",
            )

Source: GitHub Commit 846568c

Detection Methods for CVE-2026-61442

Indicators of Compromise

PATCH requests to /projects/{id}, /issues/{id}, or /agents/{id} from accounts that did not create the target resource.
Project records where lead_id was reassigned shortly before a successful DELETE on the same project.
Audit log entries showing owner-created resources modified or deleted by non-owner workspace members.

Detection Strategies

Correlate application logs to flag PATCH-then-DELETE sequences on projects where the actor differs from the original owner.
Alert on any modification of lead_id fields performed by a user who is not currently an owner or admin.
Baseline PATCH activity per user and surface deviations against historical resource ownership.

Monitoring Recommendations

Enable verbose API access logging for PraisonAI Platform routes and forward to a central SIEM.
Track workspace membership changes alongside resource mutation events to build accountability trails.
Retain database change history for projects, issues, and agents tables for post-incident review.

How to Mitigate CVE-2026-61442

Immediate Actions Required

Upgrade praisonai-platform to version 0.1.9 or later, which enforces owner/admin authorization on PATCH routes.
Audit existing projects for unexpected lead_id changes and restore ownership where tampering is suspected.
Review workspace membership rosters and remove accounts that no longer require write access.

Patch Information

The fix is delivered in commit 846568c7a5d8ce9e71e56e4c213f027c04909753 and described in the GitHub Security Advisory GHSA-c78w-2q4r-68r7. Additional analysis is available in the VulnCheck Advisory. The patch introduces validate_issue_refs_in_workspace and tightens permission dependencies on mutation routes.

Workarounds

Restrict PraisonAI Platform workspaces to trusted members until the upgrade to 0.1.9 is complete.
Place the platform API behind a reverse proxy that blocks PATCH requests to /projects, /issues, and /agents from non-admin accounts.
Disable self-service workspace invitations to limit the pool of accounts that can reach the vulnerable endpoints.

bash

# Upgrade to the patched release
pip install --upgrade "praisonai-platform>=0.1.9"

# Verify the installed version
pip show praisonai-platform | grep -i version