Live › vulnerability › CVE-2026-57121
Go to dashboardPraisonAI's multi-agent platform lets any workspace member permanently delete projects, agents, issues, labels and issue dependencies created by others. A single malicious or compromised member account can wipe an entire workspace's content with no way to recover it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running praisonai-platform between and with multiple workspace members. Exposure depends on whether members can authenticate to the workspace; a single-user instance has little to lose from a peer deleting content. Installations already on or later are not affected.
0.1.40.1.50.1.5No product ranges from the sources yet.
0.1.4 up to but not including 0.1.50.1.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-57121")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.