CVE-2026-62179

Name of the Vulnerable Software and Affected Versions praisonai-platform versions prior to 0.1.9

Description Issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member can delete a dependency from an owner-created issue by accessing it through a member-owned related issue endpoint. This occurs because the route accepts either endpoint and only verifies delete permissions against the caller-selected URL issue, bypassing the intended restriction on owner-created workflow state. Additionally, workspace members can create dependency edges on owner-created issues without owner or admin authority.

Recommendations Update praisonai-platform to version 0.1.9. As a temporary workaround, restrict the use of the DELETE /workspaces/{workspace id}/issues/{issue id}/dependencies/{dep id} endpoint to only users with admin or owner privileges.