Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

praisonai-platform

25 known vulnerabilities (6 critical, 15 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
0.1.9 (Jun 25, 2026): no advisory affects it
Newest unaffected release
0.1.9 (Jun 25, 2026), the latest release
Advisories
25 · 6 critical, 15 high, 4 medium
Weekly downloads
313
Dependents
0
Releases
8 since 0.1.0 (Apr 14, 2026)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 25 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 25

  • PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

    Affected: from 0.1.4, fixed in 0.1.6.

    Fixed in 0.1.6 (released Jun 17, 2026, 128 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-62179Medium 6.5

    PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

    Affected: fixed in 0.1.9.

    Fixed in 0.1.9 (released Jun 25, 2026, 104 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-57147Critical 9.8

    praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

    Affected: fixed in 0.1.6.

    Fixed in 0.1.6 (released Jun 17, 2026, 90 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-57148Critical 9.8

    praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

    Affected: fixed in 0.1.6.

    Fixed in 0.1.6 (released Jun 17, 2026, 90 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 80 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-47416Critical 9.6

    praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label…

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-47413Critical 9.6

    praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-47411Medium 6.5

    praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-47410Critical 9.8

    praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is…

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

Show all 25 advisoriesShow fewer advisories

  • praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-47408Medium 6.5

    praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-47407Critical 9.4

    PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking +…

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

    Affected: fixed in 0.1.4.

    Fixed in 0.1.4 (released May 19, 2026, 63 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

    Affected: fixed in 0.1.9.

    Fixed in 0.1.9 (released Jun 25, 2026, 20 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH

    Affected: fixed in 0.1.9.

    Fixed in 0.1.9 (released Jun 25, 2026, 16 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies

    Affected: fixed in 0.1.9.

    Fixed in 0.1.9 (released Jun 25, 2026, 15 days before disclosure).

    The latest release, 0.1.9, is not affected.

  • CVE-2026-58653Medium 5.3

    PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update

    Affected: fixed in 0.1.8.

    Fixed in 0.1.8 (released Jun 17, 2026, 15 days before disclosure).

    The latest release, 0.1.9, is not affected.