Findings

CVE-2026-61442

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Published Oct 8, 2026 · updated Oct 15, 2026

# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass ## Summary lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For projects, the member can first patch to their own user id and then delete the owner-created project, bypassing a delete guard that correctly returned before the reassignment. ## Technical Details The affected boundary is the difference between "is a workspace member" and "owns or administers this resource". defines , , , and . only checks that the caller has at least the role in the workspace, while allows delete only for workspace admins/owners or the resource owner. The project update route in defines with . It passes , , , , and into . then writes when supplied. The paired project delete route first loads the project and calls . This means an ordinary member can mutate the ownership field that the delete route later trusts. The same update/delete asymmetry exists for issues and agents. defines with only , validates referenced ids are in the workspace, then calls to write fields including , , , , , and . The paired delete route checks . defines with only and calls to write fields including , , and ; the paired delete route checks . The intended owner/admin boundary is visible from the delete routes and from the local negative controls: a workspace member cannot directly delete an owner-created project, issue, or agent, and a non-member cannot patch an issue. The vulnerability is that the PATCH routes do not apply an equivalent owner/admin or resource-specific update guard. ## PoV the PoV starts an in-memory FastAPI app backed by SQLite, creates an owner, a member, and an outsider, adds the member to the owner's workspace, then exercises the project, issue, and agent routes without touching any live service. Essential excerpt: The full PoV script is included in the appendix below as . ## Po