PraisonAI Platform: Missing ownership check allows deletion of others' content
Summary
The PraisonAI platform API does not check ownership or role on six DELETE endpoints for projects, agents, issues, labels, issue dependencies and issue-label attachments. Any authenticated workspace member can permanently delete content created by the workspace owner or other members, which can wipe a workspace's content irreversibly. The attack requires only a low-privilege member account and no user interaction; confidentiality is not affected.
Affected
- praisonai-platform (PyPI) from 0.1.4 before 0.1.5 (>=0.1.4, <0.1.5)
Fixed in
- Fixed in praisonai-platform 0.1.5 according to the vendor advisory. Verify the release on PyPI before rollout.
Workaround
- No vendor workaround documented.
- Until the upgrade, limit workspace membership to trusted users and remove unused accounts.
- Back up or export workspace content and confirm it can be restored.
- Restrict network access to the platform API where possible.
Exploitation
- No confirmed in-the-wild exploitation found.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS 0.00329 (low).
Our recommendation
- Confirm the fixed release on PyPI and the GitHub advisory, then upgrade to 0.1.5 or later.
- Review workspace member lists and remove unknown or departed accounts.
- Back up workspace data before and after the upgrade.
- Check whether the related workspace-wipe issue CVE-2026-47412 is fixed in your version.
- Monitor for unexpected deletions of projects, issues or agents.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rh39-9c67-59mh github.com
- OSV: PYSEC-2026-3526 osv.dev
- NVD record via Vulners: CVE-2026-57121 vulners.com
- CIRCL vulnerability details: GHSA-rh39-9c67-59mh vulnerability.circl.lu
- Strix CVE details: CVE-2026-57121 www.strix.ai
- GitHub Advisory GHSA-g8rr-7rj2-f627 (related workspace deletion issue) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:56.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.