CVE-2026-62180

Name of the Vulnerable Software and Affected Versions praisonai-platform versions 0.1.6 through 0.1.8

Description An authorization gap allows ordinary workspace members to modify shared labels and manage label assignments on issues created by owners or administrators. While direct label deletion is restricted to administrative roles, members can still rename and recolor shared labels or add and remove labels from owner-created issues. This issue results in a loss of integrity regarding workflow and triage state.

Technical details include the following affected API endpoints:

These endpoints fail to verify if the caller has owner or admin authority, relying only on general workspace membership. The LabelService.update(), LabelService.add to issue(), and LabelService.remove from issue() functions are called without sufficient authorization checks.

Recommendations For versions 0.1.6 through 0.1.8, require workspace admin or owner authority for the PATCH /workspaces/{workspace id}/labels/{label id}, POST /workspaces/{workspace id}/issues/{issue id}/labels/{label id}, and DELETE /workspaces/{workspace id}/issues/{issue id}/labels/{label id} endpoints when the target label or issue was not created by the caller.