Medium severity6.5NVD Advisory· Published Jul 15, 2026· Updated Jul 18, 2026
CVE-2026-61440
CVE-2026-61440
Description
PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
praisonai-platformPyPI | < 0.1.9 | 0.1.9 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-xxgv-vgvj-qvxhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-61440ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-62180ghsaADVISORY
- github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753nvdWEB
- github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xxgv-vgvj-qvxhnvdWEB
- www.vulncheck.com/advisories/praisonai-platform-before-authorization-bypass-via-label-endpointsnvdWEB
News mentions
0No linked articles in our index yet.