CVE-2026-62179 · GHSA-mxmx-rh57-jx58
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
- Risk score
- 45/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-own…
- Affected
- praisonai-platform (pip) <= 0.1.8
- Fix
- Upgrade praisonai-platform to 0.1.9 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| praisonai-platform | pip | <= 0.1.8 | 0.1.9 |
References
Original description
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.
Last activity 7 Oct 2026. Patch Forecast updates every hour.