Authorization Bypass in PraisonAI Platform Affects Dependency Management

CVE-2026-61441

What is CVE-2026-61441?

The PraisonAI Platform prior to version 0.1.9 features a vulnerability that improperly authorizes the deletion of issue dependencies. The issue arises from the DELETE dependency route, which permits access based solely on the caller-selected URL issue. This flaw allows any workspace member to delete dependencies they normally would not have permissions to remove. By leveraging a member-owned issue endpoint, an unauthorized user can bypass owner/admin controls, leading to the potential removal of critical issue dependencies without proper authorization.

References