CVE-2026-61440 · GHSA-xxgv-vgvj-qvxh
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
- Risk score
- 50/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 15 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxo…
- Affected
- praisonai-platform (pip) <= 0.1.8
- Fix
- Upgrade praisonai-platform to 0.1.9 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| praisonai-platform | pip | <= 0.1.8 | 0.1.9 |
References
- https://github.com/advisories/GHSA-xxgv-vgvj-qvxh
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xxgv-vgvj-qvxh
- https://nvd.nist.gov/vuln/detail/CVE-2026-61440
- https://nvd.nist.gov/vuln/detail/CVE-2026-62180
- https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753
- https://www.vulncheck.com/advisories/praisonai-platform-before-authorization-bypass-via-label-endpoints
- https://github.com/advisories/GHSA-xxgv-vgvj-qvxh
Original description
PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization.
Last activity 8 Oct 2026. Patch Forecast updates every hour.