CVE-2026-57121: 
Python vulnerability analysis and mitigation

CVE-2026-57121 is an improper authorization vulnerability in the PraisonAI Platform API that allows workspace members to permanently delete resources created by other members or the workspace owner. The flaw affects praisonai-platform (pip) version 0.1.4 and was disclosed on June 17, 2026, with a patch published on June 18, 2026. The patched version is 0.1.6 (or >= 0.1.5 per the original advisory). It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, GitHub Advisory DB).

The root cause is CWE-285 (Improper Authorization): the DELETE handlers for all six content resource endpoints verify only that the requesting user is a workspace member, but omit any check confirming the user created the resource or holds an owner/admin role. The documented permission model explicitly prohibits members from editing or deleting others' content, but this policy is not enforced in code. The six vulnerable endpoints are DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}, .../agents/{agent_id}, .../issues/{issue_id}, .../labels/{label_id}, .../issues/{issue_id}/dependencies/{dep_id}, and .../issues/{issue_id}/labels/{label_id} — all return 204 No Content when a member deletes another user's resource instead of the expected 403 Forbidden. A public proof-of-concept is included in the security advisory (GitHub Advisory).

A malicious or compromised workspace member can irreversibly wipe an entire workspace's content — including projects, AI agents, issues, labels, issue dependencies, and issue-label attachments — without any elevated privileges. There is no confidentiality impact (no data is exposed), but integrity and availability are both rated High: all workspace data can be permanently destroyed with no recovery path. Workspace owners and all other members sharing a workspace with an untrusted account are at risk (GitHub Advisory, GitHub Advisory DB).

A working proof-of-concept is publicly documented in the GitHub Security Advisory, requiring only two accounts (an owner and a member) and standard HTTP requests. No special tooling or elevated privileges beyond workspace membership are needed, and no user interaction is required. There is no current evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability does not appear in the CISA KEV catalog. EPSS score data was not available at time of publication (GitHub Advisory).

1. Obtain membership: Register or compromise a member-role account in the target PraisonAI workspace (POST /api/v1/auth/register or via social engineering the workspace owner to add the attacker as a member).
2. Enumerate resources: Use the member's bearer token to list workspace resources (e.g., GET /api/v1/workspaces/{workspace_id}/projects/) and collect resource IDs for projects, agents, issues, and labels created by other users.
3. Issue DELETE requests: For each target resource, send a DELETE request using the member's bearer token — for example:

   DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}
   Authorization: Bearer <member_token>

4. Confirm deletion: The server responds with 204 No Content. A subsequent GET on the same resource returns 404 Not Found, confirming permanent deletion.
5. Repeat across resource types: Apply the same technique to agents, issues, labels, issue dependencies, and issue-label attachments to wipe the entire workspace's content irreversibly (GitHub Advisory).

• Network/API Logs: A high volume of DELETE requests to /api/v1/workspaces/{workspace_id}/projects/, /agents/, /issues/, or /labels/ endpoints from a single member-role user token, especially targeting resource IDs not created by that user.
• Logs: HTTP 204 No Content responses to DELETE requests from accounts with the member role on resources owned by other users; subsequent 404 Not Found responses when owners attempt to retrieve deleted resources.
• Application Behavior: Sudden disappearance of projects, agents, issues, or labels from a workspace without corresponding owner/admin activity in audit logs (GitHub Advisory).

Upgrade praisonai-platform to version 0.1.6 (or >= 0.1.5 per the original advisory), which introduces ownership and role checks on all six affected DELETE endpoints. No configuration-based workaround is available; the fix requires a code-level patch. As an interim measure, workspace owners should audit member lists and remove untrusted accounts until the upgrade can be applied (GitHub Advisory, GitHub Advisory DB).

The vulnerability was reported by security researcher adamyordan and published by the PraisonAI maintainer (MervinPraison) on June 17, 2026, with a patch released the following day. No broader media coverage, vendor statements beyond the advisory, or notable community commentary were identified at time of publication (GitHub Advisory).