CVE-2026-56835

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

PraisonAI Slack app_mention bypasses configured user/channel authorization

Summary

PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler.

A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when:

• the sender is not in BotConfig.allowed_users;
• the channel is not in BotConfig.allowed_channels;
• unknown_user_policy="deny" is configured; and
• the same event content is correctly dropped by the normal message handler.

This is a sibling-handler guard-coverage issue. Slack documents app_mention as a distinct event type rather than a message.* event, so deployments subscribed to app mentions can route unauthorized sender input around the guarded message path.

Affected product

• Repository: MervinPraison/PraisonAI
• Package: praisonai
• Component: src/praisonai/praisonai/bots/slack.py
• Configuration component: src/praisonai-agents/praisonaiagents/bots/config.py

Confirmed affected:

v3.11.0  7f37d754a72511a71f7eeaaa8e9f367a5dc45fd8
v3.11.14 44b800df0eddf32dd5242f47da7513e4a3159d76
v3.12.0  51f95ad904a6616b35caede1cd74026ec8f7152c
v4.4.5   9a3363c900fa3be3fce5483be7f6c1f418757ebb
v4.4.6   90b00f9a25ee5c7ccf4b6ab3152700e1881f262d
v4.4.12  7d0657632fc477673153ad116cecf692b454bfa3
v4.5.2   8ddbb4ee7152d3fa68fbaaf6e6c610ae03d938d3
v4.5.16  02a19776517cc76483fd58dcd6a5fdf8c2c45170
v4.5.28  16f93251766505a79f237a0f07f68a0ecb17e358
v4.5.112 bfe3d94bad6db92fc2927c2e3c081ae8303e209e
v4.5.128 b4e3a8a84ade44ac3dd9102b792cdb4311a95937
v4.6.10  4b1b17b963cbd0625e41394a30168c95b26429b2
v4.6.33  dfbb8d78ec7e8dc7118bc722ab1b2524bc98ddab
v4.6.34  e5928449f73f66cc8af1de61621aa974ab255133
v4.6.56  d3c4a2afadfbf3a3e172e460e607ba4efad263a6
v4.6.57  e90d92231853161ad931f3498da57651a9f8b528
v4.6.58  1ad58ca02975ff1398efeda694ea2ab78f20cf3e

Unaffected boundary control:

v3.10.24 de1734c29a50af18cf8c69e1d1d90e0f8e391aae

v3.10.24 does not contain src/praisonai/praisonai/bots/slack.py.

Suggested affected range: praisonai >= 3.11.0, <= 4.6.58.

Root cause

The guarded message handler converts the Slack event into a BotMessage, then applies channel and sender policy before any agent call:

@self._app.event("message")
async def handle_message(event, say):
    if event.get("bot_id"):
        return

    bot_message = self._convert_event_to_message(event)
    bot_message._channel_type = "slack"
    self.fire_message_received(bot_message)

    if not self.config.is_channel_allowed(
        bot_message.channel.channel_id if bot_message.channel else ""
    ):
        return

    user_id = bot_message.sender.user_id if bot_message.sender else ""
    is_explicitly_allowed = (
        bool(self.config.allowed_users) and self.config.is_user_allowed(user_id)
    )
    if not is_explicitly_allowed:
        user_allowed = await UnknownUserHandler.handle(bot_message, self._bot_context)
        if not user_allowed:
            return

Only after these checks does handle_message call the session manager and agent.

The adjacent app_mention handler strips the bot mention and directly invokes the agent session. It never calls is_channel_allowed(), is_user_allowed(), or UnknownUserHandler.handle():

@self._app.event("app_mention")
async def handle_mention(event, say):
    if event.get("bot_id"):
        return

    text = event.get("text", "")
    if self._bot_user:
        text = text.replace(f"<@{self._bot_user.user_id}>", "").strip()

    if self._agent:
        user_id = event.get("user", "unknown")
        response = await self._session.chat(
            self._agent, user_id, text,
            chat_id=str(event.get("channel", "")),
            thread_id=event.get("thread_ts", "") or "",
           …

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

PraisonAI Slack app_mention bypasses configured user/channel authorization

Summary

PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler.

A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when:

• the sender is not in BotConfig.allowed_users;
• the channel is not in BotConfig.allowed_channels;
• unknown_user_policy="deny" is configured; and
• the same event content is correctly dropped by the normal message handler.

This is a sibling-handler guard-coverage issue. Slack documents app_mention as a distinct event type rather than a message.* event, so deployments subscribed to app mentions can route unauthorized sender input around the guarded message path.

Affected product

• Repository: MervinPraison/PraisonAI
• Package: praisonai
• Component: src/praisonai/praisonai/bots/slack.py
• Configuration component: src/praisonai-agents/praisonaiagents/bots/config.py

Confirmed affected:

v3.11.0  7f37d754a72511a71f7eeaaa8e9f367a5dc45fd8
v3.11.14 44b800df0eddf32dd5242f47da7513e4a3159d76
v3.12.0  51f95ad904a6616b35caede1cd74026ec8f7152c
v4.4.5   9a3363c900fa3be3fce5483be7f6c1f418757ebb
v4.4.6   90b00f9a25ee5c7ccf4b6ab3152700e1881f262d
v4.4.12  7d0657632fc477673153ad116cecf692b454bfa3
v4.5.2   8ddbb4ee7152d3fa68fbaaf6e6c610ae03d938d3
v4.5.16  02a19776517cc76483fd58dcd6a5fdf8c2c45170
v4.5.28  16f93251766505a79f237a0f07f68a0ecb17e358
v4.5.112 bfe3d94bad6db92fc2927c2e3c081ae8303e209e
v4.5.128 b4e3a8a84ade44ac3dd9102b792cdb4311a95937
v4.6.10  4b1b17b963cbd0625e41394a30168c95b26429b2
v4.6.33  dfbb8d78ec7e8dc7118bc722ab1b2524bc98ddab
v4.6.34  e5928449f73f66cc8af1de61621aa974ab255133
v4.6.56  d3c4a2afadfbf3a3e172e460e607ba4efad263a6
v4.6.57  e90d92231853161ad931f3498da57651a9f8b528
v4.6.58  1ad58ca02975ff1398efeda694ea2ab78f20cf3e

Unaffected boundary control:

v3.10.24 de1734c29a50af18cf8c69e1d1d90e0f8e391aae

v3.10.24 does not contain src/praisonai/praisonai/bots/slack.py.

Suggested affected range: praisonai >= 3.11.0, <= 4.6.58.

Root cause

The guarded message handler converts the Slack event into a BotMessage, then applies channel and sender policy before any agent call:

@self._app.event("message")
async def handle_message(event, say):
    if event.get("bot_id"):
        return

    bot_message = self._convert_event_to_message(event)
    bot_message._channel_type = "slack"
    self.fire_message_received(bot_message)

    if not self.config.is_channel_allowed(
        bot_message.channel.channel_id if bot_message.channel else ""
    ):
        return

    user_id = bot_message.sender.user_id if bot_message.sender else ""
    is_explicitly_allowed = (
        bool(self.config.allowed_users) and self.config.is_user_allowed(user_id)
    )
    if not is_explicitly_allowed:
        user_allowed = await UnknownUserHandler.handle(bot_message, self._bot_context)
        if not user_allowed:
            return

Only after these checks does handle_message call the session manager and agent.

The adjacent app_mention handler strips the bot mention and directly invokes the agent session. It never calls is_channel_allowed(), is_user_allowed(), or UnknownUserHandler.handle():

@self._app.event("app_mention")
async def handle_mention(event, say):
    if event.get("bot_id"):
        return

    text = event.get("text", "")
    if self._bot_user:
        text = text.replace(f"<@{self._bot_user.user_id}>", "").strip()

    if self._agent:
        user_id = event.get("user", "unknown")
        response = await self._session.chat(
            self._agent, user_id, text,
            chat_id=str(event.get("channel", "")),
            thread_id=event.get("thread_ts", "") or "",
           …

PraisonAI Slack app_mention bypasses configured user/channel authorization

Summary

PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler.

A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when:

• the sender is not in BotConfig.allowed_users;
• the channel is not in BotConfig.allowed_channels;
• unknown_user_policy="deny" is configured; and
• the same event content is correctly dropped by the normal message handler.

This is a sibling-handler guard-coverage issue. Slack documents app_mention as a distinct event type rather than a message.* event, so deployments subscribed to app mentions can route unauthorized sender input around the guarded message path.

Affected product

• Repository: MervinPraison/PraisonAI
• Package: praisonai
• Component: src/praisonai/praisonai/bots/slack.py
• Configuration component: src/praisonai-agents/praisonaiagents/bots/config.py

Confirmed affected:

v3.11.0  7f37d754a72511a71f7eeaaa8e9f367a5dc45fd8
v3.11.14 44b800df0eddf32dd5242f47da7513e4a3159d76
v3.12.0  51f95ad904a6616b35caede1cd74026ec8f7152c
v4.4.5   9a3363c900fa3be3fce5483be7f6c1f418757ebb
v4.4.6   90b00f9a25ee5c7ccf4b6ab3152700e1881f262d
v4.4.12  7d0657632fc477673153ad116cecf692b454bfa3
v4.5.2   8ddbb4ee7152d3fa68fbaaf6e6c610ae03d938d3
v4.5.16  02a19776517cc76483fd58dcd6a5fdf8c2c45170
v4.5.28  16f93251766505a79f237a0f07f68a0ecb17e358
v4.5.112 bfe3d94bad6db92fc2927c2e3c081ae8303e209e
v4.5.128 b4e3a8a84ade44ac3dd9102b792cdb4311a95937
v4.6.10  4b1b17b963cbd0625e41394a30168c95b26429b2
v4.6.33  dfbb8d78ec7e8dc7118bc722ab1b2524bc98ddab
v4.6.34  e5928449f73f66cc8af1de61621aa974ab255133
v4.6.56  d3c4a2afadfbf3a3e172e460e607ba4efad263a6
v4.6.57  e90d92231853161ad931f3498da57651a9f8b528
v4.6.58  1ad58ca02975ff1398efeda694ea2ab78f20cf3e

Unaffected boundary control:

v3.10.24 de1734c29a50af18cf8c69e1d1d90e0f8e391aae

v3.10.24 does not contain src/praisonai/praisonai/bots/slack.py.

Suggested affected range: praisonai >= 3.11.0, <= 4.6.58.

Root cause

The guarded message handler converts the Slack event into a BotMessage, then applies channel and sender policy before any agent call:

@self._app.event("message")
async def handle_message(event, say):
    if event.get("bot_id"):
        return

    bot_message = self._convert_event_to_message(event)
    bot_message._channel_type = "slack"
    self.fire_message_received(bot_message)

    if not self.config.is_channel_allowed(
        bot_message.channel.channel_id if bot_message.channel else ""
    ):
        return

    user_id = bot_message.sender.user_id if bot_message.sender else ""
    is_explicitly_allowed = (
        bool(self.config.allowed_users) and self.config.is_user_allowed(user_id)
    )
    if not is_explicitly_allowed:
        user_allowed = await UnknownUserHandler.handle(bot_message, self._bot_context)
        if not user_allowed:
            return

Only after these checks does handle_message call the session manager and agent.

The adjacent app_mention handler strips the bot mention and directly invokes the agent session. It never calls is_channel_allowed(), is_user_allowed(), or UnknownUserHandler.handle():

@self._app.event("app_mention")
async def handle_mention(event, say):
    if event.get("bot_id"):
        return

    text = event.get("text", "")
    if self._bot_user:
        text = text.replace(f"<@{self._bot_user.user_id}>", "").strip()

    if self._agent:
        user_id = event.get("user", "unknown")
        response = await self._session.chat(
            self._agent, user_id, text,
            chat_id=str(event.get("channel", "")),
            thread_id=event.get("thread_ts", "") or "",
           …