CVE-2026-56835

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A...

CVE-2026-56835 PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A...

CVE-2026-56835 PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A...

CVE-2026-56835

The praisonai package (repository MervinPraison/PraisonAI) is vulnerable to an authorization bypass in its Slack bot integration. Specifically, the app_mention event handler (located in src/praisonai/praisonai/bots/slack.py) fails to enforce the allowed_users, allowed_channels, and unknown_user_p...

EUVD-2026-108876

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A...

CVE-2026-56835 PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A...

Mervin Praison PraisonAI authorization issue vulnerability

Versions Mervin Praison PraisonAI from 3.11.0 up to 4.6.59 contain an authorization issue vulnerability. This vulnerability arises because Slack bots fail to apply the allowedusers, allowedchannels, and unknownuser pairing policies within their appmention event handler, allowing unauthorized user...

CVE-2026-56835

PraisonAI's Slack bot applies its configured "allowedusers", "allowedchannels", and unknown-user pairing policy in the normal Slack "message" event handler, but not in the adjacent Slack "appmention" event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is...

Incorrect Authorization

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI Slack appmention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack...