PraisonAI Platform EUVD-2026-108895

The attacker must hold a valid authenticated account with the lowest 'member' role in the targeted workspace of praisonai-platform (versions 0.1.4 up to the fix); exploitation then works against the default configuration of the Platform API, since all six content DELETE endpoints (projects, agents, issues, labels, issue dependencies, issue-label attachments) enforce only workspace membership and omit any ownership or owner/admin role check. The primary limiting factor is that no exploitation is possible without prior membership in the workspace - the victim owner/admin must have invited the attacker, or an existing member credential must be compromised. No user interaction by the victim is required, and there is no confidentiality impact (deletion only).

Signals point to a genuine but bounded, insider-type risk rather than mass-exploitable internet threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) is High and consistent with the description: network-reachable API, low complexity, no user interaction, but PR:L means the attacker must already hold an authenticated workspace 'member' account - this is not unauthenticated RCE. Impact is destructive only (I:H/A:H) with no confidentiality loss (C:N), matching a mass-delete authorization flaw. The vuln.today decision label is 'this_week' (not act_now/emergency). No EPSS score and no CISA KEV entry are present in the input, and nothing indicates active exploitation, so this is not confirmed in-the-wild activity. The GHSA advisory includes a concrete step-by-step PoC. Net assessment: a real priority for any PraisonAI platform deployment that shares workspaces with untrusted or potentially compromised member accounts, but the PR:L requirement makes this a targeted insider/account-compromise risk rather than widespread opportunistic exploitation - prioritize patching this week as the decision label indicates, not as an emergency.

A disgruntled, malicious, or compromised low-privilege 'member' account in a shared PraisonAI workspace sends DELETE requests to the content endpoints and permanently destroys projects, agents, issues, labels, dependencies, and issue-label attachments created by the owner or other members. Because the endpoints check only workspace membership and not ownership or role, every deletion returns 204 and is irreversible. A detailed public PoC in the GHSA advisory demonstrates this end-to-end against a project; it is a reproduction walkthrough, not verified weaponized exploit code. Attack complexity is low and no user interaction is required, but the attacker must first hold a valid member session.