https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-19T10:49:03.692262+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-62179 CVE-2026-62179 — PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues 2026-10-19T10:49:03.721432+00:00

Affected: MervinPraison praisonai-platform

PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

 https://vulnerability.circl.lu/vuln/ghsa-mxmx-rh57-jx58 GHSA-mxmx-rh57-jx58 — PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues 2026-10-19T10:49:03.721545+00:00

Affected: PyPI: praisonai-platform

# Platform members can delete owner issue dependencies through member-owned related issues

## Summary

`praisonai-platform` issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue.

## Technical Details

The affected boundary is the difference between ordinary workspace membership and owner/admin authority over destructive changes to owner-created issue workflow state. `src/praisonai-platform/praisonai_platform/api/routes/dependencies.py` defines `DELETE /workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}`. The route first verifies that the URL `issue_id` is in the workspace, loads the dependency by `dep_id`, and accepts the dependency when either `dep.issue_id == issue_id` or `dep.depends_on_issue_id == issue_id`. It then calls `require_delete_permission(workspace_id, user, session, resource_owner_id=issue.creator_id)` for the URL issue only.

`src/praisonai-platform/praisonai_platform/api/deps.py` implements `require_delete_permission` as "admin/owner or resource owner". That helper is appropriate when the protected resource has a single owner, but the dependency route lets the caller choose either side of the relationship before the helper runs.…