GHSA-rh39-9c67-59mh: PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

Summary A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. Details The published role capability matrix explicitly restricts members from modifying others' content: | Capability | Owner | Admin | Member | |---|---|---|---| | Create issues/tasks | ✅ | ✅ | ✅ | | Edit own content | ✅ | ✅ | ✅ | | Edit others' content | ✅ | ✅ | ❌ | The DELETE handlers for all content resources check that the requesting user is a workspace member, but do not verify that the user either created the resource or holds an owner/admin role. The result is that the member role has unrestricted DELETE access over all workspace content regardless of who created it. Confirmed vulnerable endpoints: | Endpoint | Expected | Actual | |---|---|---| | DELETE /api/v1/workspaces/{workspace_id}/projects/{project_id} | 403 | 204 | | DELETE /api/v1/workspaces/{workspace_id}/agents/{agent_id} | 403 | 204 | | DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id} | 403 | 204 | | DELETE /api/v1/workspaces/{workspace_id}/labels/{label_id} | 403 | 204 | | DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id} | 403 | 204 | | DELETE /api/v1/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id} | 403 | 204 | The missing check is isolated to content resource DELETEs. PoC Requirements: Two accounts — owner (resource creator) and member (attacker). 1. Register both accounts POST /api/v1/auth/register Content-Type: application/json {"email": "owner@example.com", "password": "Password1!", "name": "owner"} POST /api/v1/auth/register Content-Type: application/json {"email": "member@example.com", "password": "Password1!", "name": "member"