Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

18003 vulnerabilities reference this CWE, most recent first.

GHSA-QHW8-6CRF-M6JV

Vulnerability from github – Published: 2026-10-11 15:31 – Updated: 2026-10-11 15:31
VLAI
Details

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles and per-module ACL action matrix.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-108712"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-11T13:17:14Z",
    "severity": "MODERATE"
  },
  "details": "SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users\u0027 ACL data. Attackers can supply another non-admin user\u0027s id in the record parameter to read that user\u0027s assigned roles and per-module ACL action matrix.",
  "id": "GHSA-qhw8-6crf-m6jv",
  "modified": "2026-10-11T15:31:02Z",
  "published": "2026-10-11T15:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108712"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SuiteCRM/SuiteCRM"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SuiteCRM/SuiteCRM-Core/blob/v8.10.2/public/legacy/modules/ACLRoles/DetailUserRole.php#L51-L53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/include/MVC/Controller/entry_point_registry.php#L71"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SuiteCRM/SuiteCRM/blob/v7.15.2/modules/ACLRoles/DetailUserRole.php#L51-L98"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@haind03/suitecrm-detailuserrole-acl-matrix-disclosure"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/suitecrm-through-7.15.2-and-8.10.2-missing-authorization-via-detailuserrole-entry-point"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-QHX2-GQWM-VMXG

Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32
VLAI
Details

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-69724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T18:19:44Z",
    "severity": "HIGH"
  },
  "details": "Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.",
  "id": "GHSA-qhx2-gqwm-vmxg",
  "modified": "2026-09-08T18:32:55Z",
  "published": "2026-09-08T18:32:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69724"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69724"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QHX6-XFPM-926J

Vulnerability from github – Published: 2026-10-10 03:30 – Updated: 2026-10-10 03:30
VLAI
Details

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-104915"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-10T03:17:04Z",
    "severity": "MODERATE"
  },
  "details": "The Academy LMS \u2013 AI Course Builder, Quizzes, Certificates \u0026 eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses.",
  "id": "GHSA-qhx6-xfpm-926j",
  "modified": "2026-10-10T03:30:20Z",
  "published": "2026-10-10T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104915"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L469"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L477"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L480"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/ajax/miscellaneous.php#L496"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/classes/abstract-ajax-handler.php#L43"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/academy/tags/4.0.2/includes/traits/courses.php#L380"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3734598%40academy\u0026new=3734598%40academy"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2640d1f8-958d-4556-919c-58df5bf15b40?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QHXJ-PMGP-X4MP

Vulnerability from github – Published: 2025-12-16 09:31 – Updated: 2026-01-20 15:32
VLAI
Details

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through <= 3.6.15.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-64631"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T09:15:55Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through \u003c= 3.6.15.",
  "id": "GHSA-qhxj-pmgp-x4mp",
  "modified": "2026-01-20T15:32:14Z",
  "published": "2025-12-16T09:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64631"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-6-15-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-6-15-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QJ28-V8QH-CCQW

Vulnerability from github – Published: 2022-06-14 00:00 – Updated: 2022-06-18 00:00
VLAI
Details

The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-25116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-13T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.",
  "id": "GHSA-qj28-v8qh-ccqw",
  "modified": "2022-06-18T00:00:18Z",
  "published": "2022-06-14T00:00:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25116"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/140a15b6-12c8-4f03-a877-3876db866852"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QJ2M-5F68-MQWF

Vulnerability from github – Published: 2024-04-22 12:30 – Updated: 2025-02-04 18:30
VLAI
Details

Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-32682"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-22T11:15:46Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in BdThemes Prime Slider \u2013 Addons For Elementor.This issue affects Prime Slider \u2013 Addons For Elementor: from n/a through 3.13.2.",
  "id": "GHSA-qj2m-5f68-mqwf",
  "modified": "2025-02-04T18:30:44Z",
  "published": "2024-04-22T12:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32682"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-13-2-broken-access-control-vulnerability-2?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QJ78-V57F-V8C2

Vulnerability from github – Published: 2024-08-19 18:32 – Updated: 2024-08-19 18:32
VLAI
Details

Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-43247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-19T18:15:10Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.",
  "id": "GHSA-qj78-v57f-v8c2",
  "modified": "2024-08-19T18:32:08Z",
  "published": "2024-08-19T18:32:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43247"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/whmpress/wordpress-whmpress-plugin-6-2-revision-5-subscriber-arbitrary-settings-change-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QJ7H-W49C-56JM

Vulnerability from github – Published: 2023-02-12 06:30 – Updated: 2023-02-21 21:30
VLAI
Details

In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-47329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-12T04:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.",
  "id": "GHSA-qj7h-w49c-56jm",
  "modified": "2023-02-21T21:30:17Z",
  "published": "2023-02-12T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47329"
    },
    {
      "type": "WEB",
      "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1621031430231134210"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QJ7V-9Q3W-P83X

Vulnerability from github – Published: 2024-11-01 15:32 – Updated: 2026-04-01 18:32
VLAI
Details

Missing Authorization vulnerability in Truepush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Truepush: from n/a through 1.0.8.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-44021"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-01T15:15:52Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Truepush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Truepush: from n/a through 1.0.8.",
  "id": "GHSA-qj7v-9q3w-p83x",
  "modified": "2026-04-01T18:32:16Z",
  "published": "2024-11-01T15:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44021"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/truepush-free-web-push-notifications/vulnerability/wordpress-truepush-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/truepush-free-web-push-notifications/wordpress-truepush-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QJ9C-59P6-8CGX

Vulnerability from github – Published: 2026-10-07 14:06 – Updated: 2026-10-07 14:06
VLAI
Summary
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Details

Summary

PraisonAI's AgentMail bot, when run in webhook (or hybrid) mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the attacker-controlled request body, so any network peer can inject messages into the agent with a spoofed sender (bypassing sender allow/block lists) and have the agent process the content and reply to an attacker-chosen address. Sibling bots (linear.py, whatsapp.py) fail closed when no secret is configured; AgentMail omits the check entirely. Runtime-confirmed; severity Medium.

Details

Affected component

  • Package: praisonai 4.6.63. File: src/praisonai/praisonai/bots/agentmail.py (AgentMailBot, webhook/hybrid mode).

Vulnerable code / root cause

Path: src/praisonai/praisonai/bots/agentmail.py

Function: _start_webhook_mode / _handle_email_webhook / _handle_message

Snippet:

# _start_webhook_mode: binds all interfaces
self._webhook_site = web.TCPSite(self._webhook_runner, "0.0.0.0", self._webhook_port)

# _handle_email_webhook: no signature/HMAC check, no auth
body = await request.json()
if body.get("type") != "message.received":
    return web.Response(status=200, text="OK")
asyncio.create_task(self._process_webhook_payload(body))   # dispatch attacker body
return web.Response(status=200, text="OK")

# _handle_message: agent processes content, replies to attacker-controlled sender
response = await self._session.chat(self._agent, sender_id, body, ...)
await self.send_message(channel_id=sender_id, ...)

Issue: attacker-controlled input is the raw webhook JSON (from, extracted_text, subject). The guard that should exist is provider signature verification — there is none here (no svix/HMAC, no webhooks_require_verification() call). The sink is self._session.chat(self._agent, ...) (agent invocation) and send_message(channel_id=sender_id, ...) (reply to the spoofed sender). Sibling handlers src/praisonai/praisonai/bots/linear.py and bots/whatsapp.py call webhooks_require_verification() and reject when no secret is set — AgentMail does not, so it fails open.

Attack flow

  1. Operator runs the AgentMail bot in webhook/hybrid mode (documented; binds 0.0.0.0, default path /webhook, default port 8080).
  2. Attacker POSTs a crafted message.received event with a spoofed from and arbitrary extracted_text.
  3. The agent processes the content; any reply is sent to the attacker-chosen sender_id.

Why existing protection is bypassed

There is no protection on this handler: no signature verification, no webhooks_require_verification() gate, no auth. Sender allow/block lists are bypassed because from is attacker-controlled.

Security boundary

Unauthenticated network peer → agent message pipeline + reply destination. Crosses the bot's inbound trust boundary (provider webhooks are expected to be signed/authenticated).

Proof of Concept

Environment

Real AgentMailBot._handle_email_webhook mounted in a local runtime (127.0.0.1:18080); the agent layer is a canary recorder (/webhook-log). No real email is sent. Runnable assets: PraisonAI-Runtime-Repro\runtime-files\.

Steps to reproduce

  1. PRAI-03-01-Webhook-Spoofed-Sender:
POST /webhook HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json

{"type":"message.received","data":{"from":"attacker@evil.example","extracted_text":"PRAISONAI_WEBHOOK_INJECT_CANARY_7f3a91 ...","subject":"hello","headers":{}}}
  1. PRAI-03-02-Agent-Reached-Response: GET /webhook-log.

Expected result

The webhook should reject unsigned/unauthenticated events; spoofed senders should not reach the agent.

Actual result

  • POST /webhook → 200 OK (no auth/signature).
  • GET /webhook-log → {"reached_agent":[{"sender":"attacker@evil.example","content":"...PRAISONAI_WEBHOOK_INJECT_CANARY_7f3a91...","source":"webhook"}],"count":1}.

Impact

Unauthenticated message injection into the agent; sender spoofing (access-control bypass); agent reply/exfiltration to an attacker-chosen address; prompt-injection surface; LLM cost abuse. If the agent has dangerous tools, escalation via prompt injection is possible.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.77"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-345",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T14:06:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nPraisonAI\u0027s AgentMail bot, when run in webhook (or hybrid) mode, starts an aiohttp webhook server bound to `0.0.0.0` and processes inbound `message.received` events **without verifying any signature/HMAC and without authentication**. The sender address and message body are taken directly from the attacker-controlled request body, so any network peer can inject messages into the agent with a spoofed sender (bypassing sender allow/block lists) and have the agent process the content and reply to an attacker-chosen address. Sibling bots (`linear.py`, `whatsapp.py`) fail closed when no secret is configured; AgentMail omits the check entirely. Runtime-confirmed; severity Medium.\n\n## Details\n\n### Affected component\n- Package: `praisonai` 4.6.63. File: `src/praisonai/praisonai/bots/agentmail.py` (`AgentMailBot`, webhook/hybrid mode).\n\n### Vulnerable code / root cause\n\nPath:\n`src/praisonai/praisonai/bots/agentmail.py`\n\nFunction:\n`_start_webhook_mode` / `_handle_email_webhook` / `_handle_message`\n\nSnippet:\n```python\n# _start_webhook_mode: binds all interfaces\nself._webhook_site = web.TCPSite(self._webhook_runner, \"0.0.0.0\", self._webhook_port)\n\n# _handle_email_webhook: no signature/HMAC check, no auth\nbody = await request.json()\nif body.get(\"type\") != \"message.received\":\n    return web.Response(status=200, text=\"OK\")\nasyncio.create_task(self._process_webhook_payload(body))   # dispatch attacker body\nreturn web.Response(status=200, text=\"OK\")\n\n# _handle_message: agent processes content, replies to attacker-controlled sender\nresponse = await self._session.chat(self._agent, sender_id, body, ...)\nawait self.send_message(channel_id=sender_id, ...)\n```\nIssue: attacker-controlled input is the raw webhook JSON (`from`, `extracted_text`, `subject`). The guard that *should* exist is provider signature verification \u2014 there is **none** here (no svix/HMAC, no `webhooks_require_verification()` call). The sink is `self._session.chat(self._agent, ...)` (agent invocation) and `send_message(channel_id=sender_id, ...)` (reply to the spoofed sender). Sibling handlers `src/praisonai/praisonai/bots/linear.py` and `bots/whatsapp.py` call `webhooks_require_verification()` and reject when no secret is set \u2014 AgentMail does not, so it fails open.\n\n### Attack flow\n1. Operator runs the AgentMail bot in webhook/hybrid mode (documented; binds `0.0.0.0`, default path `/webhook`, default port 8080).\n2. Attacker POSTs a crafted `message.received` event with a spoofed `from` and arbitrary `extracted_text`.\n3. The agent processes the content; any reply is sent to the attacker-chosen `sender_id`.\n\n### Why existing protection is bypassed\nThere is no protection on this handler: no signature verification, no `webhooks_require_verification()` gate, no auth. Sender allow/block lists are bypassed because `from` is attacker-controlled.\n\n### Security boundary\nUnauthenticated network peer \u2192 agent message pipeline + reply destination. Crosses the bot\u0027s inbound trust boundary (provider webhooks are expected to be signed/authenticated).\n\n## Proof of Concept\n\n### Environment\nReal `AgentMailBot._handle_email_webhook` mounted in a local runtime (`127.0.0.1:18080`); the agent layer is a canary recorder (`/webhook-log`). No real email is sent. Runnable assets: `PraisonAI-Runtime-Repro\\runtime-files\\`.\n\n### Steps to reproduce\n1. `PRAI-03-01-Webhook-Spoofed-Sender`:\n```http\nPOST /webhook HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"type\":\"message.received\",\"data\":{\"from\":\"attacker@evil.example\",\"extracted_text\":\"PRAISONAI_WEBHOOK_INJECT_CANARY_7f3a91 ...\",\"subject\":\"hello\",\"headers\":{}}}\n```\n2. `PRAI-03-02-Agent-Reached-Response`: `GET /webhook-log`.\n\n### Expected result\nThe webhook should reject unsigned/unauthenticated events; spoofed senders should not reach the agent.\n\n### Actual result\n- `POST /webhook` \u2192 `200 OK` (no auth/signature).\n- `GET /webhook-log` \u2192 `{\"reached_agent\":[{\"sender\":\"attacker@evil.example\",\"content\":\"...PRAISONAI_WEBHOOK_INJECT_CANARY_7f3a91...\",\"source\":\"webhook\"}],\"count\":1}`.\n\n## Impact\nUnauthenticated message injection into the agent; sender spoofing (access-control bypass); agent reply/exfiltration to an attacker-chosen address; prompt-injection surface; LLM cost abuse. If the agent has dangerous tools, escalation via prompt injection is possible.",
  "id": "GHSA-qj9c-59p6-8cgx",
  "modified": "2026-10-07T14:06:56Z",
  "published": "2026-10-07T14:06:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qj9c-59p6-8cgx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61428"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-agentmail-before-message-injection-via-webhook"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list