CVE-2026-61440: Mervinpraison Praisonai

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization.

Affected products

• Mervinpraison Praisonai: before 0.1.9 (fixed in 0.1.9)

Published 2026-07-15. Last modified 2026-07-18.