CyberRota Analysis
AI-GeneratedThe PraisonAI Platform prior to version 0.1.9 is vulnerable due to inadequate authorization for label and issue-label mutations, enabling workspace members to modify shared labels and issue associations without proper permissions. This could lead to unauthorized changes in project organization and tracking, potentially disrupting workflows and causing confusion among team members. Organizations using this platform should prioritize patching to mitigate the risk of internal misuse by workspace members.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization.