CVE-2026-62179

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

Platform members can delete owner issue dependencies through member-owned related issues

Summary

praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue.

Technical Details

The affected boundary is the difference between ordinary workspace membership and owner/admin authority over destructive changes to owner-created issue workflow state. src/praisonai-platform/praisonai_platform/api/routes/dependencies.py defines DELETE /workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}. The route first verifies that the URL issue_id is in the workspace, loads the dependency by dep_id, and accepts the dependency when either dep.issue_id == issue_id or dep.depends_on_issue_id == issue_id. It then calls require_delete_permission(workspace_id, user, session, resource_owner_id=issue.creator_id) for the URL issue only.

src/praisonai-platform/praisonai_platform/api/deps.py implements require_delete_permission as "admin/owner or resource owner". That helper is appropriate when the protected resource has a single owner, but the dependency route lets the caller choose either side of the relationship before the helper runs. If an owner-created issue is related to a member-owned issue, the member can select the member-owned issue in the URL, satisfy resource_owner_id == user.id, and delete the dependency edge that is also returned from the owner-created issue's dependency list.

The same route family also lets any workspace member create dependency edges on owner-created issues with only require_workspace_member. POST /workspaces/{workspace_id}/issues/{issue_id}/dependencies/ verifies that both issues are in the workspace, then calls DependencyService.create(issue_id, body.depends_on_issue_id, body.type) without checking owner/admin authority over the primary issue. This report focuses on the stronger delete-guard bypass because the current owner issue endpoint returns 403 while the related member issue endpoint deletes the same edge with 204.

The intended boundary is visible from the local controls: a member deleting an owner-only dependency through an owner issue endpoint returns 403, an owner deleting the same dependency returns 204, and a non-member creating a dependency returns 403. The vulnerability is the endpoint-selection path where the member uses a related member-owned issue as the URL issue to delete an owner-side dependency edge.

PoV

the PoV starts the PraisonAI Platform FastAPI app in process with an in-memory SQLite database. It creates an owner, a member, and a non-member, creates one owner-owned issue and one member-owned issue in the same workspace, creates a dependency from the owner issue to the member issue, then exercises the dependency delete route through both issue endpoints.

Essential excerpt:

dep_resp = await client.post(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/",
    json={"depends_on_issue_id": member_issue_id, "type": "blocks"},
    headers=owner_headers,
)
dep_id = dep_resp.json()["id"]

member_delete_owner_endpoint = await client.delete(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/{dep_id}",
    headers=member_headers,
)

member_delete_member_endpoint = await client.delete(
    f"/api/v1/workspaces/{workspace_id}/issues/{member_issue_id}/dependencies/{dep_id}",
    headers=member_headers,
)

owner_list_after_member_delete = await client.get(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/",
    headers=owner_headers,
)

The full PoV script is included in the appendix below as…

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a dependency through an owner-created issue endpoint (which returns 403) can delete the same dependency edge by targeting a related member-owned issue endpoint, because permission is validated against the member-owned issue's owner. This allows members to bypass owner/admin authorization and remove owner-created issue dependencies.

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

Platform members can delete owner issue dependencies through member-owned related issues

Summary

praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue.

Technical Details

The affected boundary is the difference between ordinary workspace membership and owner/admin authority over destructive changes to owner-created issue workflow state. src/praisonai-platform/praisonai_platform/api/routes/dependencies.py defines DELETE /workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}. The route first verifies that the URL issue_id is in the workspace, loads the dependency by dep_id, and accepts the dependency when either dep.issue_id == issue_id or dep.depends_on_issue_id == issue_id. It then calls require_delete_permission(workspace_id, user, session, resource_owner_id=issue.creator_id) for the URL issue only.

src/praisonai-platform/praisonai_platform/api/deps.py implements require_delete_permission as "admin/owner or resource owner". That helper is appropriate when the protected resource has a single owner, but the dependency route lets the caller choose either side of the relationship before the helper runs. If an owner-created issue is related to a member-owned issue, the member can select the member-owned issue in the URL, satisfy resource_owner_id == user.id, and delete the dependency edge that is also returned from the owner-created issue's dependency list.

The same route family also lets any workspace member create dependency edges on owner-created issues with only require_workspace_member. POST /workspaces/{workspace_id}/issues/{issue_id}/dependencies/ verifies that both issues are in the workspace, then calls DependencyService.create(issue_id, body.depends_on_issue_id, body.type) without checking owner/admin authority over the primary issue. This report focuses on the stronger delete-guard bypass because the current owner issue endpoint returns 403 while the related member issue endpoint deletes the same edge with 204.

The intended boundary is visible from the local controls: a member deleting an owner-only dependency through an owner issue endpoint returns 403, an owner deleting the same dependency returns 204, and a non-member creating a dependency returns 403. The vulnerability is the endpoint-selection path where the member uses a related member-owned issue as the URL issue to delete an owner-side dependency edge.

PoV

the PoV starts the PraisonAI Platform FastAPI app in process with an in-memory SQLite database. It creates an owner, a member, and a non-member, creates one owner-owned issue and one member-owned issue in the same workspace, creates a dependency from the owner issue to the member issue, then exercises the dependency delete route through both issue endpoints.

Essential excerpt:

dep_resp = await client.post(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/",
    json={"depends_on_issue_id": member_issue_id, "type": "blocks"},
    headers=owner_headers,
)
dep_id = dep_resp.json()["id"]

member_delete_owner_endpoint = await client.delete(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/{dep_id}",
    headers=member_headers,
)

member_delete_member_endpoint = await client.delete(
    f"/api/v1/workspaces/{workspace_id}/issues/{member_issue_id}/dependencies/{dep_id}",
    headers=member_headers,
)

owner_list_after_member_delete = await client.get(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/",
    headers=owner_headers,
)

The full PoV script is included in the appendix below as…

Platform members can delete owner issue dependencies through member-owned related issues

Summary

praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue.

Technical Details

The affected boundary is the difference between ordinary workspace membership and owner/admin authority over destructive changes to owner-created issue workflow state. src/praisonai-platform/praisonai_platform/api/routes/dependencies.py defines DELETE /workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}. The route first verifies that the URL issue_id is in the workspace, loads the dependency by dep_id, and accepts the dependency when either dep.issue_id == issue_id or dep.depends_on_issue_id == issue_id. It then calls require_delete_permission(workspace_id, user, session, resource_owner_id=issue.creator_id) for the URL issue only.

src/praisonai-platform/praisonai_platform/api/deps.py implements require_delete_permission as "admin/owner or resource owner". That helper is appropriate when the protected resource has a single owner, but the dependency route lets the caller choose either side of the relationship before the helper runs. If an owner-created issue is related to a member-owned issue, the member can select the member-owned issue in the URL, satisfy resource_owner_id == user.id, and delete the dependency edge that is also returned from the owner-created issue's dependency list.

The same route family also lets any workspace member create dependency edges on owner-created issues with only require_workspace_member. POST /workspaces/{workspace_id}/issues/{issue_id}/dependencies/ verifies that both issues are in the workspace, then calls DependencyService.create(issue_id, body.depends_on_issue_id, body.type) without checking owner/admin authority over the primary issue. This report focuses on the stronger delete-guard bypass because the current owner issue endpoint returns 403 while the related member issue endpoint deletes the same edge with 204.

The intended boundary is visible from the local controls: a member deleting an owner-only dependency through an owner issue endpoint returns 403, an owner deleting the same dependency returns 204, and a non-member creating a dependency returns 403. The vulnerability is the endpoint-selection path where the member uses a related member-owned issue as the URL issue to delete an owner-side dependency edge.

PoV

the PoV starts the PraisonAI Platform FastAPI app in process with an in-memory SQLite database. It creates an owner, a member, and a non-member, creates one owner-owned issue and one member-owned issue in the same workspace, creates a dependency from the owner issue to the member issue, then exercises the dependency delete route through both issue endpoints.

Essential excerpt:

dep_resp = await client.post(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/",
    json={"depends_on_issue_id": member_issue_id, "type": "blocks"},
    headers=owner_headers,
)
dep_id = dep_resp.json()["id"]

member_delete_owner_endpoint = await client.delete(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/{dep_id}",
    headers=member_headers,
)

member_delete_member_endpoint = await client.delete(
    f"/api/v1/workspaces/{workspace_id}/issues/{member_issue_id}/dependencies/{dep_id}",
    headers=member_headers,
)

owner_list_after_member_delete = await client.get(
    f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/dependencies/",
    headers=owner_headers,
)

The full PoV script is included in the appendix below as…