PYSEC-2026-3518: PraisonAI Slack app_mention bypasses configured user/channel authorization
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowedusers; the channel is not in BotConfig.allowedchannels; unknownuserpolicy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Who can exploit this issue?
Any Slack workspace user who can mention the PraisonAI bot in a channel where the Slack app is present can trigger a configured agent. The user does not need to be listed in BotConfig.allowed_users, and the channel does not need to be listed in BotConfig.allowed_channels.
Does setting unknown_user_policy to "deny" prevent exploitation?
No. The app_mention handler bypasses the unknown-user pairing policy as well as the configured user and channel allowlists. The same content would be dropped by the normal Slack message handler, but accepted through an app mention.
Which versions are affected and what version fixes the problem?
PraisonAI versions 3.11.0 through versions before 4.6.59 are affected. Version 4.6.59 contains the patch.
What can be done if upgrading is not immediately possible?
Limit who can mention the bot and restrict the channels in which the Slack app is present. This reduces exposure because exploitation requires a workspace user to mention the bot in a channel containing the app.