CVE-2026-62179: CVE-2026-62179: Missing Authorization in praisonai-platform Dependency Deletion Route

CVE-2026-62179: Missing Authorization in praisonai-platform Dependency Deletion Route

Vulnerability ID: CVE-2026-62179
CVSS Score: 6.5
Published: 2026-10-07

A missing authorization vulnerability (CWE-862) exists in praisonai-platform versions prior to 0.1.9, allowing low-privileged workspace members to delete planning dependencies on issues owned by administrators by routing the deletion request through an attacker-owned issue.

TL;DR

Low-privileged workspace members can delete planning and task dependencies created by administrators in praisonai-platform (< 0.1.9) by routing requests through issues they own.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-862 / CWE-863
• Attack Vector: Network
• CVSS: 6.5 (Medium)
• EPSS: Not Yet Assigned
• Impact: Workflow Integrity Loss
• Exploit Status: PoC available
• KEV Status: Not Listed

Affected Systems

• praisonai-platform
• praisonai-platform: < 0.1.9 (Fixed in: 0.1.9)

Mitigation Strategies

• Upgrade praisonai-platform to version 0.1.9 or higher.
• Restrict workspace write access for untrusted or low-privileged users.
• Audit active issue dependencies for unexpected deletions or alterations.

Remediation Steps:

1. Locate deployments utilizing the praisonai-platform package.
2. Update the dependency using: pip install --upgrade praisonai-platform>=0.1.9
3. Restart the application services to load the updated router module.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-mxmx-rh57-jx58
• https://www.cve.org/CVERecord?id=CVE-2026-62179
• https://osv.dev/vulnerability/GHSA-mxmx-rh57-jx58

---

Read the full report for CVE-2026-62179 on our website for more details including interactive diagrams and full exploit analysis.