CVE-2026-61441

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-61441

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61441.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-61441

Aliases

Published

2026-07-10T13:58:06Z

Modified

2026-10-28T02:30:43Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies

Details

PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a dependency through an owner-created issue endpoint (which returns 403) can delete the same dependency edge by targeting a related member-owned issue endpoint, because permission is validated against the member-owned issue's owner. This allows members to bypass owner/admin authorization and remove owner-created issue dependencies.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61441.json"
}

References

Affected packages

Git / github.com/mervinpraison/praisonai

Affected ranges

Type

GIT

Repo

https://github.com/mervinpraison/praisonai

Events

Introduced

Fixed

33d4322296c3274d638880725d065e50521c41b1

Fixed

846568c7a5d8ce9e71e56e4c213f027c04909753

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.1.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "846568c7a5d8ce9e71e56e4c213f027c04909753"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.0.55

0.0.56

0.0.57

0.0.59rc5

v0.*

v0.0.1

v0.0.18

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.28

v0.0.29

v0.0.30

v0.0.31

v0.0.32

v0.0.33

v0.0.34

v0.0.35

v0.0.36

v0.0.37

v0.0.38

v0.0.39

v0.0.40

v0.0.41

v0.0.42

v0.0.43

v0.0.44

v0.0.45

v0.0.46

v0.0.47

v0.0.48

v0.0.49

v0.0.50

v0.0.51

v0.0.52

v0.0.53

v0.0.54

v0.0.58

v0.0.59

v0.0.59rc1

v0.0.59rc11

v0.0.59rc2

v0.0.59rc3

v0.0.59rc4

v0.0.59rc5

v0.0.59rc6

v0.0.59rc7

v0.0.59rc8

v0.0.59rc9

v0.0.61

v0.0.62

v0.0.63

v0.0.64

v0.0.65

v0.0.66

v0.0.67

v0.0.68

v0.0.69

v0.0.70

v0.0.71

v0.0.72

v0.0.73

v0.0.74

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61441.json"