CVE-2026-62179

PraisonAI is a multi-agent teams system. In "praisonai-platform" prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same...

CVE-2026-62179

In praisonai-platform prior to version 0.1.9 , a vulnerability exists where workspace members can delete owner-created issue dependencies. The root cause is an incorrect authorization flaw where the system checks permissions against the caller-selected URL issue instead of verifying the owner's p...

CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

GHSA-MXMX-RH57-JX58 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...

CVE-2026-58438

A flaw was found in Gitea. This vulnerability, identified as an Insecure Direct Object Reference IDOR, exists within the issue-dependency removal function. A remote attacker with write access to issues in one repository can exploit this flaw to remove a dependency link to an issue in a private...

CVE-2026-58438

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58438

The Git repository management system Gitea is vulnerable to a cross-repository IDOR (Insecure Direct Object Reference) in the issue-dependency removal functionality. This flaw allows a malicious actor to tamper with and comment on private repositories they are not authorized to access. A proof-of...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

EUVD-2026-58165

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58438: Missing Authorization

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

GO-2026-6085 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...

PT-2026-65382

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...

GHSA-XV9X-FJ9G-VJ6H Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Details RemoveDependency in routers/web/repo/issuedependency.go takes a removeDependencyID form parameter identifying the other issue by its global numeric ID, and fetches it with issuesmodel.GetIssueByIDctx, depID - no repository or permission check at all. It then calls...

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Details RemoveDependency in routers/web/repo/issuedependency.go takes a removeDependencyID form parameter identifying the other issue by its global numeric ID, and fetches it with issuesmodel.GetIssueByIDctx, depID - no repository or permission check at all. It then calls...