CVE-2026-62179: PraisonAI Platform authorization bypass in issue dependency deletion

CVE-2026-62179 · Severity: medium · CVSS 6.5 · Published 2026-10-07

PraisonAI Platform is an AI-powered project management system that manages issue dependencies and workflow state. A workspace member can delete workflow dependencies that an owner created on their issues by exploiting an authorization bypass in the dependency deletion endpoint. This allows members to remove blocking or related issue relationships that owners intended to protect project execution order, and also to create false dependencies on owner-created issues.

Technologies: praisonai-platform (PyPI). Vendors: PraisonAI, PyPI.

Quick answers

Is CVE-2026-62179 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62179 being exploited in the wild.
How severe is CVE-2026-62179?
Medium severity, with a CVSS score of 6.5, published 7 October 2026.
Which products and versions are affected?
PraisonAI Platform 0.1.6 through 0.1.8; praisonai-platform (PyPI) <= 0.1.8.
Is there a fix for CVE-2026-62179?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-62179 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-62179?
Check whether you run PraisonAI Platform or praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The DELETE dependency endpoint accepts either endpoint of a bidirectional dependency edge in the URL but performs authorization checks only against the caller-selected issue, allowing a member to delete owner-created dependencies by addressing them through a member-owned related issue. The route loads the dependency and checks if either `dep.issue_id == issue_id` or `dep.depends_on_issue_id == issue_id`, then calls `require_delete_permission` with only the URL issue's creator, not both ends. A member can satisfy the permission check by selecting their own issue URL while deleting the same dependency.

Affected products

  • PraisonAI PraisonAI Platform 0.1.6 through 0.1.8

Identifiers

  • CVE-2026-62179
  • GHSA-mxmx-rh57-jx58

Timeline

  • 2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.