Is CVE-2026-61442 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61442 being exploited in the wild.

How severe is CVE-2026-61442?

High severity, with a CVSS score of 7.1, published 11 July 2026.

Which products and versions are affected?

praisonai-platform (PyPI) <= 0.1.8, ECOSYSTEM:introduced=0,fixed=0.1.9.

Is there a fix for CVE-2026-61442?

Yes. praisonai-platform (PyPI): upgrade to 0.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61442 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61442?

Check whether you run praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61442: MervinPraison PraisonAI Platform authorization bypass in PATCH routes

Q: Is there a fix for CVE-2026-61442?

Yes. praisonai-platform (PyPI): upgrade to 0.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61442 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-61442?

Check whether you run praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61442 · Severity: high · CVSS 7.1 · Published 2026-07-11

PraisonAI Platform, a framework for managing AI agents and projects, contains a security flaw where standard workspace members can modify or delete resources created by administrators or owners. By exploiting this, a regular user can change project details, reassign ownership to themselves, and subsequently delete entire projects or modify AI agent instructions. This could lead to unauthorized data modification, service disruption, and loss of critical project configurations.

Technologies: praisonai-platform (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61442 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61442 being exploited in the wild.
How severe is CVE-2026-61442?: High severity, with a CVSS score of 7.1, published 11 July 2026.
Which products and versions are affected?: praisonai-platform (PyPI) <= 0.1.8, ECOSYSTEM:introduced=0,fixed=0.1.9.
Is there a fix for CVE-2026-61442?: Yes. praisonai-platform (PyPI): upgrade to 0.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61442 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61442?: Check whether you run praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai-platform (PyPI): upgrade to 0.1.9 or later
```
pip install "praisonai-platform>=0.1.9"
```

Technical details

A missing authorization check (CWE-862) exists in the PATCH routes for projects, issues, and agents in PraisonAI Platform before version 0.1.9. While DELETE routes correctly enforce 'require_delete_permission' (restricting actions to owners or admins), the corresponding PATCH routes only require the 'workspace-member' role. An authenticated workspace member can use a PATCH request to modify resource fields, including the 'lead_id' or 'owner_id'. By reassigning these ownership fields to their own user ID, the member can then successfully call the DELETE route, effectively bypassing the intended authorization model to delete or alter resources they do not own.

Affected products

MervinPraison PraisonAI Platform < 0.1.9

Identifiers

CVE-2026-61442
GHSA-c78w-2q4r-68r7
PYSEC-2026-4262

Timeline

2026-06-17: patched: Fix committed to repository
2026-06-25: advisory: GitHub Security Advisory published
2026-07-11: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.