CVE-2026-56832: PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaito a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Who can exploit this issue?
Any non-bot Discord user who can post messages in the configured approval channel can approve a pending dangerous tool call. The user does not need to be the intended approver or reply to the specific approval request.
What conditions are required for exploitation?
A dangerous tool call must be pending approval in the configured Discord channel, and an attacker must be able to post there. Sending an approval-classified message such as "yes" after the approval prompt appears can trigger approval.
Are default deployments affected?
The provided information does not identify whether DiscordApproval is enabled or configured by default. Deployments using the Discord approval backend are affected from version 4.5.2 through versions before 4.6.59.
What should be done if upgrading is not immediately possible?
Restrict posting access to the configured Discord approval channel to trusted approvers, and avoid leaving dangerous tool calls pending in that channel. Because approvals are not bound to a specific request, channel membership is the relevant control until the fix is deployed.
How can I determine whether my deployment is affected?
Check whether the deployment uses praisonai.bots.DiscordApproval and is running version 4.5.2 or later but earlier than 4.6.59. Review whether users other than intended approvers can post in its configured approval channel.