CyberRota Analysis
AI-GeneratedThe PraisonAI Platform prior to version 0.1.9 has a vulnerability that allows unauthorized deletion of issue dependencies due to improper authorization checks on the DELETE dependency route. This flaw enables workspace members to bypass owner/admin permissions by targeting related member-owned issue endpoints, potentially disrupting project management and collaboration. Organizations using this platform should prioritize updating to the latest version to mitigate the risk of unauthorized dependency manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a dependency through an owner-created issue endpoint (which returns 403) can delete the same dependency edge by targeting a related member-owned issue endpoint, because permission is validated against the member-owned issue's owner. This allows members to bypass owner/admin authorization and remove owner-created issue dependencies.