Description
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
Published: 2026-10-23
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Authorization bypass via Slack app_mention allows unauthorized users to trigger PraisonAI agents
Action: Patch
AI Analysis

Impact

PraisonAI’s Slack bot applies authorization checks for ordinary message events but fails to enforce them for app_mention events. An attacker who can mention the bot in a Slack channel can activate any configured agent, even when the sender is not listed in BotConfig.allowed_users, the channel is not in BotConfig.allowed_channels, and the unknown_user_policy is set to "deny". This circumvention is a classic missing authorization and missing access control flaw, represented by CWE-862 and CWE-863, and can lead to unauthorized execution of the bot’s functionality, exposing sensitive data or enabling further malicious actions within the workspace.

Affected Systems

The MervinPraison PraisonAI Slack app, versions 3.11.0 through 4.6.58 inclusive, is affected. The issue has been fixed in version 4.6.59 and later.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is simple: any Slack user who can mention the bot in a channel where the bot is installed can trigger the configured agent. No additional privileges or knowledge of internal state are required, so the exploit is likely to be feasible in many environments.

Generated by OpenCVE AI on October 23, 2026 at 14:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PraisonAI to version 4.6.59 or later to apply the official fix for the app_mention authorization bypass.
  • Remove the bot from any Slack channels and disable the app_mention event trigger in the Slack app configuration to block unauthorized mentions until the upgrade is performed.
  • Review and enforce explicit user authorization before executing any PraisonAI agent logic for all event types, or apply a temporary rule to drop messages containing @bot in channels until the official patch is deployed.

Generated by OpenCVE AI on October 23, 2026 at 14:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-qvpf-j64c-jmhr PraisonAI Slack app_mention bypasses configured user/channel authorization
History

Fri, 23 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Mervinpraison
Mervinpraison praisonai
Vendors & Products Mervinpraison
Mervinpraison praisonai

Fri, 23 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
Title PraisonAI Slack app_mention bypasses configured user/channel authorization
Weaknesses CWE-862
CWE-863
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Mervinpraison Praisonai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-23T11:57:11.852Z

Reserved: 2026-06-23T14:55:09.117Z

Link: CVE-2026-56835

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-23T12:18:14.897

Modified: 2026-10-23T12:18:15.013

Link: CVE-2026-56835

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T14:15:07Z

Weaknesses