CVE-2026-62179— PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
Quick assessment
Affected
MervinPraison praisonai-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体团队系统。在 0.1.9 版本之前，存在一个依赖项删除权限错误的问题，可能导致对错误一侧的依赖关系边进行授权操作。具体而言，工作区成员无法通过由所有者创建的问题端点删除依赖项，但可以通过成员拥有的相关问题的端点删除相同的依赖项。这是因为该路由接受两种端点，但仅在调用者选择的 URL 问题中检查删除权限。该问题已在版本 0.1.9 中得到修复。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62179
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | praisonai-platform | < 0.1.9 | - |
|
II. Public POCs for CVE-2026-62179
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62179
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-62179 (1)
IV. Related Vulnerabilities
Same product: praisonai-platform
-
CVE-2026-48169
PraisonAI has Cross-Workspace IDOR and Privilege Escalation -
CVE-2026-47419
praisonai-platform: Agent endpoints accept any agent_id with -
CVE-2026-47418
praisonai-platform: Project endpoints accept any project_id -
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id wi -
CVE-2026-47416
praisonai-platform: Any workspace member can promote themsel
Same vendor: MervinPraison
-
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-c -
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT se -
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and -
CVE-2026-57139
PraisonAI MCPServer exposes unauthenticated HTTP tools/call -
CVE-2026-57133
PraisonAI utility shell safe-command wrapper allowlist bypas
Same weakness: CWE-862
-
CVE-2026-27434
WordPress WP Rentals theme <= 3.14.2 - Broken Access Control -
CVE-2026-104390
WordPress Booktics plugin <= 1.0.27 - Broken Access Control -
CVE-2026-105876
WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive -
CVE-2026-103075
WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control -
CVE-2026-93026
Veeam Backup & Replication备份查看器修改主键漏洞
V. Comments for CVE-2026-62179
No comments yet