Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-62179PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
Medium 6.5
In plain English
A medium-severity missing authorization in praisonai-platform from MervinPraison. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | praisonai-platform | 0.1.9 | GHSA-mxmx-rh57-jx58 |
| PyPI | praisonai-platform | 0.1.9 | PYSEC-2026-4263 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MervinPraison | praisonai-platform | < 0.1.9 |
Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N