PraisonAI’s DiscordApproval component mistakenly validates any non‑bot message in the approval channel that contains approval‑like text such as "yes" as a legitimate approval for a pending dangerous tool call. The component does not verify that the message is tied to a specific request or that the author is authorized to approve the action. An attacker who can post in the configured channel can therefore trigger the execution of a high‑risk tool by simply sending an approval message after the request appears, effectively bypassing the intended approval process. The flaw is a classic case of missing authorization checks and unverified input used for state transition, allowing unauthorized users to elevate their privileges and potentially compromise the system.

Vendor MervinPraison, product PraisonAI. Versions from 4.5.2 through 4.6.58 (inclusive) are vulnerable. The issue was fixed in version 4.6.59, so any release before that is at risk.

The CVSS score of 8.8 indicates a high severity impact. While the EPSS score is unavailable, the flaw’s simplicity—any user with posting rights can trigger approval—yields a high likelihood of exploitation in environments where the Discord approval channel is unsecured. This vulnerability is not listed in the CISA KEV catalog, but it has already been reported and patched. The attack vector is straightforward: publish an approval message in the channel, with no requirement for the message to be a reply or otherwise linked to the pending request. The resulting elevated privileges can lead to execution of dangerous commands or data exfiltration.