# Duplicate Advisory: PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead…

Source: https://junglewise.ai/threats/duplicate-advisory-praisonai-platform-member-patch-routes-allow-owner-09a248de  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.1 · Published 2026-07-11

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-c78w-2q4r-68r7. This link is maintained to preserve external references.

### Original Description
PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check.

Technologies: [praisonai-platform (PyPI)](https://junglewise.ai/threats/technologies/praisonai-platform). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.1, published 11 July 2026.

**Which products and versions are affected?** praisonai-platform (PyPI) <= 0.1.8.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected?** Check whether you run praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- praisonai-platform (PyPI) <= 0.1.8

## Related threats

- [PraisonAI missing authorization check on DELETE endpoints](https://junglewise.ai/threats/cve-2026-57121-praisonai-missing-ownership-check-on-delete-endpoints-allows)
- [PraisonAI Platform authorization bypass in issue dependency deletion](https://junglewise.ai/threats/cve-2026-62179-praisonai-platform-members-can-delete-owner-issue-dependencies)
- [PraisonAI JWT authentication bypass with hardcoded dev secret](https://junglewise.ai/threats/cve-2026-57148-praisonai-jwt-authentication-bypass-with-hardcoded-dev-secret)
- [PraisonAI JWT authentication bypass with hardcoded secret](https://junglewise.ai/threats/cve-2026-57147-praisonai-jwt-authentication-bypass-with-hardcoded-secret)
- [PraisonAI Platform IDOR and privilege escalation in Platform API](https://junglewise.ai/threats/cve-2026-48169-praisonai-platform-idor-and-privilege-escalation-in-platform-api)