CVE-2026-56835

The praisonai package (repository MervinPraison/PraisonAI) is vulnerable to an authorization bypass in its Slack bot integration. Specifically, the app_mention event handler (located in src/praisonai/praisonai/bots/slack.py) fails to enforce the allowed_users, allowed_channels, and unknown_user_p...

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI Slack appmention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack...