# CVE-2026-62179: PraisonAI Platform authorization bypass in issue dependency deletion

Source: https://junglewise.ai/threats/cve-2026-62179-praisonai-platform-members-can-delete-owner-issue-dependencies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-62179 · Severity: medium · CVSS 6.5 · Published 2026-10-07

PraisonAI Platform is an AI-powered project management system that manages issue dependencies and workflow state. A workspace member can delete workflow dependencies that an owner created on their issues by exploiting an authorization bypass in the dependency deletion endpoint. This allows members to remove blocking or related issue relationships that owners intended to protect project execution order, and also to create false dependencies on owner-created issues.

Technologies: [praisonai-platform (PyPI)](https://junglewise.ai/threats/technologies/praisonai-platform). Vendors: [PraisonAI](https://junglewise.ai/threats/vendors/praisonai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-62179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62179 being exploited in the wild.

**How severe is CVE-2026-62179?** Medium severity, with a CVSS score of 6.5, published 7 October 2026.

**Which products and versions are affected?** PraisonAI Platform 0.1.6 through 0.1.8; praisonai-platform (PyPI) <= 0.1.8.

**Is there a fix for CVE-2026-62179?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62179 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62179?** Check whether you run PraisonAI Platform or praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DELETE dependency endpoint accepts either endpoint of a bidirectional dependency edge in the URL but performs authorization checks only against the caller-selected issue, allowing a member to delete owner-created dependencies by addressing them through a member-owned related issue. The route loads the dependency and checks if either `dep.issue_id == issue_id` or `dep.depends_on_issue_id == issue_id`, then calls `require_delete_permission` with only the URL issue's creator, not both ends. A member can satisfy the permission check by selecting their own issue URL while deleting the same dependency.

## Affected products

- PraisonAI PraisonAI Platform 0.1.6 through 0.1.8

## Identifiers

- CVE-2026-62179
- GHSA-mxmx-rh57-jx58

## Timeline

- 2026-10-07: disclosed

## Related threats

- [PraisonAI missing authorization check on DELETE endpoints](https://junglewise.ai/threats/cve-2026-57121-praisonai-missing-ownership-check-on-delete-endpoints-allows)
- [PraisonAI JWT authentication bypass with hardcoded dev secret](https://junglewise.ai/threats/cve-2026-57148-praisonai-jwt-authentication-bypass-with-hardcoded-dev-secret)
- [PraisonAI JWT authentication bypass with hardcoded secret](https://junglewise.ai/threats/cve-2026-57147-praisonai-jwt-authentication-bypass-with-hardcoded-secret)
- [PraisonAI Platform IDOR and privilege escalation in Platform API](https://junglewise.ai/threats/cve-2026-48169-praisonai-platform-idor-and-privilege-escalation-in-platform-api)
- [MervinPraison PraisonAI Platform IDOR in agent CRUD endpoints](https://junglewise.ai/threats/cve-2026-47419-mervinpraison-praisonai-platform-idor-in-agent-crud-endpoints)