CVE-2026-61440

Name of the Vulnerable Software and Affected Versions PraisonAI Platform versions prior to 0.1.9

Description The platform fails to properly authorize mutations related to labels and issue-labels. This allows users with workspace member privileges to rename and recolor shared labels, as well as add or remove labels on issues created by the owner. This is achieved by exploiting PATCH and POST/DELETE endpoints to alter the shared label taxonomy and manipulate issue-label associations without the required owner or admin authorization.

Recommendations Update PraisonAI Platform to version 0.1.9 or later.