CVE-2026-58653mediumCWE-639

CVE-2026-58653: falha de média gravidade em PraisonAI

PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update

Publicada em

Seguir esta CVE+ Monitorar PraisonAI+ Monitorar praisonai-platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
PraisonAI before 0.1.7 fails to validate that project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
PraisonAI · PraisonAI
CVEs relacionadas — PraisonAI

No mesmo produto, das mais perigosas para as menos.

CVE-2026-56078HIGHPraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitorEPSS 0.9%CVE-2026-56076HIGHPraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointEPSS 0.6%CVE-2026-56075HIGHPraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode OverrideEPSS 0.6%CVE-2026-56077HIGHPraisonAI - Information Disclosure via Shared MultiAgentLedger StateEPSS 0.4%CVE-2026-56074MEDIUMPraisonAI - Tool Approval Cache Bypass via Coarse-Grained CachingEPSS 0.2%