CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-61440?
CVE-2026-61440 is a high-severity vulnerability in MervinPraison PraisonAI, published on 15 Jul 2026.
Official description
PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization.
Weakness: CWE-862
Which versions are affected by CVE-2026-61440?
3 open source packages ship an affected version, including praisonai-platform.
| Package | Affected | Fixed in |
|---|---|---|
praisonai-platform PyPI | All versions | 0.1.9 |
praisonai-platform PyPI | All versions | 0.1.9 |
praisonai-platform PyPI | All versions | 0.1.9 |
How do I fix CVE-2026-61440?
Upgrade praisonai-platform to 0.1.9 or later.
Is CVE-2026-61440 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61440 exists.
Sources
Also known as CVE-2026-62180, GHSA-xxgv-vgvj-qvxh, PYSEC-2026-4264.