PT-2026-61760 · Praisonai · Praisonai
CVE-2026-56835
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
8.3
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
praisonai versions 3.11.0 through 4.6.58
Description
The Slack bot in PraisonAI fails to apply configured user and channel authorization policies when processing
app mention events. While the standard message event handler correctly enforces allowed users, allowed channels, and the unknown user policy, the app mention handler bypasses these checks and directly invokes the agent session. This allows any Slack user who can mention the bot in a channel where the app is present to trigger the agent, even if they are not authorized. This occurs because app mention is treated as a distinct event type from message.* events. An attacker can exploit this to submit arbitrary prompts to the agent, potentially impacting the confidentiality and integrity of the deployment depending on the tools the agent has access to.Recommendations
For versions 3.11.0 through 4.6.58, implement a shared authorization preflight for all Slack ingress paths. This should involve converting
app mention events using convert event to message() and applying the same is channel allowed(), is user allowed(), and UnknownUserHandler.handle() checks used in the message handler before invoking the agent session.Fix
Incorrect Authorization
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai