VulnSocial

CVE-2026-61442Disclosure

LOWCVSS 7.1 · HIGH

Exploit discussion active in current signal (4 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-07-11: 4PoC Mentioned / Linked · 2026-07-11: 1Patch / Workaround · 2026-07-11: 1Technical Details · 2026-07-11: 307-11
Signal classification3 categories
Disclosure
250.0%
Patch
125.0%
PoC
125.0%
Referenced assets4 URLs
Full discourse4 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - PraisonAI Platform Authorization Bypass on PATCH Routes (CVE-2026-61442) PraisonAI Platform does not enforce owner/admin authorization on the PATCH routes for projects, issues, and agents - they only check for the workspace-member role. A low-privileged member can therefore modify records created by the workspace owner. For projects, this chains into a full takeover of the record: a member reassigns lead_id to their own user ID, then deletes the owner-created project, bypassing the delete route's owner/admin check. CVSS 7.1, integrity impact. It's part of the current cluster of PraisonAI disclosures. 👉Upgrade praisonai-platform to 0.1.9 or later.

    Post summary

    The post discloses a high‑severity authorization bypass (CVE‑2026‑61442) in PraisonAI’s PATCH routes and recommends upgrading to version 0.1.9 or later to remediate the issue.

    0000086
    247 followersView on X
  • MalwareObserver@MalwareObserver
    PoC

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-61442](https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f02... https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753 #ZeroDay #PatchManagement #Vulnerability

    Post summary

    A GitHub commit referencing CVE-2026-61442 suggests a Proof of Concept was released, but the post lacks further technical details, exploitation evidence, or remediation information.

    0000039
    10 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-61442 PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only requi… https://www.cve.org/CVERecord?id=CVE-2026-61442 ----- Traducción: CVE-2026-61442 Pra… http://infoflow.cloud`

    Post summary

    The CVE details a privilege escalation flaw in PraisonAI Platform (<0.1.9) where PATCH endpoints do not enforce owner/admin authentication, permitting unauthorized modifications.

    0000032
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-61442 PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only requi… https://www.cve.org/CVERecord?id=CVE-2026-61442

    Post summary

    CVE-2026-61442 reveals that PraisonAI Platform versions prior to 0.1.9 lack owner/admin authorization checks on PATCH routes for projects, issues, and agents, resulting in potential unauthorized modifications.

    00000577
    57.8K followersView on X

Explore more

Back to dashboard