CVE-2026-56835: PraisonAI Slack app_mention bypasses configured user/channel authorization
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowedusers; the channel is not in BotConfig.allowedchannels; unknownuserpolicy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are affected?
PraisonAI versions 3.11.0 through versions before 4.6.59 are affected when using the Slack bot. The issue applies where a workspace user can mention the bot in a channel that contains the Slack app.
What does an attacker need to exploit this issue?
An attacker needs only to be a Slack workspace user able to send an app mention in a channel where the PraisonAI Slack app is present. They do not need to be listed in allowed_users, use an allowed channel, or pass an unknown_user_policy set to deny.
Are restrictive Slack authorization settings sufficient mitigation?
No. The app_mention handler bypasses allowed_users, allowed_channels, and the unknown-user pairing policy, even though the normal message handler enforces them.
How can I remediate the issue?
Upgrade PraisonAI to version 4.6.59, which contains the patch. Until upgrading, exposure exists for users who can mention the bot in channels where the app is installed.