CVE-2026-61441 describes an authorization bypass vulnerability in MervinPraison's PraisonAI Platform prior to version 0.1.9. The DELETE dependency API route accepts either endpoint of a dependency edge but only checks delete permissions against the issue endpoint chosen by the caller. Consequently, a workspace member who lacks permission to delete a dependency via an owner-created issue endpoint (which correctly returns 403 Forbidden) can circumvent this restriction by issuing the delete request against a related member-owned issue endpoint. Since permission is validated against the member-owned issue's owner, this allows unauthorized deletion of owner-created issue dependencies, effectively bypassing intended access controls.

This vulnerability allows workspace members with limited delete permissions to remove dependencies created by owners or administrators by exploiting inconsistent authorization checks. This could lead to unauthorized modification of project dependencies, potentially disrupting workflows or causing data integrity issues within the PraisonAI platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict workspace member permissions carefully and monitor for suspicious deletion activity. Avoid relying solely on endpoint-based permission checks for critical operations.