Resource Deletion Vulnerability in PraisonAI by Mervin Praison
CVE-2026-57121

8.1HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
23 October 2026

What is CVE-2026-57121?

PraisonAI, a multi-agent team system, contains a vulnerability that permits a workspace member to permanently delete resources—such as projects, agents, and issue-related attachments—created by any workspace owner or other members. This flaw exists in versions 0.1.4 and earlier where DELETE operations fail to verify ownership or user roles, allowing malicious users to erase important data irreparably. Version 0.1.5 addresses this vulnerability by implementing necessary role checks.

Affected Version(s)

PraisonAI >= 0.1.4, < 0.1.5

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.