CVE-2026-61442 PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH
Workspace members can modify or delete owner-created records in PraisonAI Platform due to missing authorization checks on PATCH routes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61442?
CVE-2026-61442 is a high-severity missing authorization vulnerability in MervinPraison PraisonAI, published on 11 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check.
Weakness: CWE-862
Which versions are affected by CVE-2026-61442?
3 open source packages ship an affected version, including praisonai-platform.
| Package | Affected | Fixed in |
|---|---|---|
praisonai-platform PyPI | All versions | 0.1.9 |
praisonai-platform PyPI | All versions | 0.1.9 |
praisonai-platform PyPI | All versions | 0.1.9 |
How do I fix CVE-2026-61442?
Upgrade praisonai-platform to 0.1.9 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-61442 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61442 exists.
Sources
Also known as GHSA-c78w-2q4r-68r7, PYSEC-2026-4262.