CVE-2026-61440 is a missing authorization vulnerability in MervinPraison's PraisonAI platform prior to version 0.1.9. It permits attackers with workspace member privileges to bypass intended access controls on label and issue-label mutation operations. Specifically, these attackers can rename and recolor shared labels and manipulate label assignments on issues they do not own by exploiting PATCH and POST/DELETE API endpoints. This flaw compromises the integrity of shared label taxonomy and issue-label associations within the workspace.

Attackers with workspace member privileges can alter shared label taxonomy and issue-label associations without requiring owner or administrator authorization. This can lead to unauthorized changes in issue tracking and categorization, potentially disrupting project management and collaboration workflows. There is no indication of privilege escalation beyond workspace member level or direct code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 0.1.9, upgrading to version 0.1.9 or later is recommended once an official fix is released. Until then, restrict workspace member privileges where possible to limit exposure.