CyberRota Analysis
AI-GeneratedThe PraisonAI Platform prior to version 0.1.9 is vulnerable due to inadequate authorization checks on PATCH routes, allowing workspace members to modify and delete owner-created projects, issues, and agents. This flaw can lead to unauthorized data manipulation and potential loss of critical project information. Organizations using this platform should prioritize patching to mitigate the risk of exploitation and protect their project integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check.