PraisonAI Platform CVE-2026-61440

Exploitation requires an authenticated account with workspace member privileges (CVSS PR:L) in a shared PraisonAI Platform workspace running a version before 0.1.9; the attacker must be able to reach the label and issue-label REST endpoints over the network. The limiting factor is that this is not an unauthenticated flaw - the attacker must already be a member of the target workspace, so multi-tenant deployments that invite untrusted or lightly vetted members are most exposed, while single-user or fully trusted-member installations face little practical risk. No special non-default configuration or user interaction is needed beyond having a member role.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1 and correctly captures a network-reachable, low-complexity flaw exploitable by an already-authenticated low-privileged member with no user interaction, affecting integrity only - no confidentiality or availability loss. The rated VI:H (high integrity impact) appears generous: the manipulable data is label metadata and issue-label associations, which is bounded taxonomy/organizational data rather than critical system state, so real-world integrity impact is closer to partial/low. There is no EPSS score, no KEV listing, and no POC in the provided data, meaning exploitation is theoretical and requires insider (member-level) access to the target workspace, sharply limiting the realistic threat population. This is a legitimate multi-tenant/collaboration authorization bug worth patching but not an internet-facing unauthenticated priority - treat it as medium, not critical.

A low-privileged user who has been invited to a shared PraisonAI workspace uses their valid session to call the label PATCH endpoint and rename or recolor shared labels, then calls the issue-label POST/DELETE endpoints to add or strip labels on issues created by the workspace owner. No user interaction or elevated role is needed, so a disgruntled or compromised member can silently corrupt the workspace's label taxonomy and mislabel issues. No public exploit code has been identified, but the attack requires only ordinary API calls with member-level credentials.