CVE-2026-57121 — PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

CVE-2026-57121

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API PUBLISHED

Description (CNA)

PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.

Affected (CNA)

Vendor / product	Versions
MervinPraison / PraisonAI	affected >= 0.1.4, < 0.1.5

CWE

CWE-285

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.