{"id":"CVE-2026-56835","kind":"vulnerability","aliases":["CVE-2026-56835"],"related":[],"title":"PraisonAI Slack bot: app_mention skips user and channel allowlists","description":"PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy=\"deny\" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.","summary":"PraisonAI's Slack bot enforces its allowed_users, allowed_channels and unknown-user deny policy only in the normal message handler, not in the app_mention handler. A Slack workspace user can therefore trigger the configured agent by mentioning the bot in a channel, even when those policies should block them.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python","slack"],"not_affected_if":["not-using-slack-bot","version-4.6.59-or-later"],"how_to_check":"- Check the installed PraisonAI version; affected range is from `3.11.0` up to, but not including, `4.6.59`.\n- Check whether the Slack bot is configured with `BotConfig` `allowed_users`, `allowed_channels` or `unknown_user_policy=\"deny\"`; if it is not running the Slack integration, it is not exposed.","fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, restrict who can mention the bot in Slack, for example by removing the app from channels that should not reach the agent.","status":"open","published_at":"2026-10-23T12:18:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:02:06+00:00","updated_at":"2026-10-25T03:02:06+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:02:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, restrict who can mention the bot in Slack, for example by removing the app from channels that should not reach the agent.","reach":"network","title":"PraisonAI Slack bot: app_mention skips user and channel allowlists","impact":"medium","summary":"PraisonAI's Slack bot enforces its allowed_users, allowed_channels and unknown-user deny policy only in the normal message handler, not in the app_mention handler. A Slack workspace user can therefore trigger the configured agent by mentioning the bot in a channel, even when those policies should block them.","category":"ai-tooling","nicknames":[],"who_cares":["praisonai","slack","python","ai-agents"],"confidence":0.8,"needs_auth":"yes","worst_case":"Unauthorized Slack users can trigger the configured agent despite deny policies.","analyst_note":"","how_to_check":"- Check the installed PraisonAI version; affected range is from `3.11.0` up to, but not including, `4.6.59`.\n- Check whether the Slack bot is configured with `BotConfig` `allowed_users`, `allowed_channels` or `unknown_user_policy=\"deny\"`; if it is not running the Slack integration, it is not exposed.","needs_analyst":false,"not_affected_if":["not-using-slack-bot","version-4.6.59-or-later"],"who_is_affected":"Teams that run the PraisonAI Slack bot integration on a version from `3.11.0` before `4.6.59`. Any Slack workspace member who can mention the bot in a channel where the app is installed can reach the agent, so the exposure is the workspace membership rather than the public internet. Teams not using the Slack bot, or already on `4.6.59` or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000954,"input_tokens":3437,"output_tokens":1220,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56835':13A,16A '3.11.0':87C '4.6.59':91C,192C 'adjac':120C 'agent':19B,63B,82C,149C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'allow':32B,34B,99C,101C 'allowlist':10A 'app':4A,51B,122C,141C 'appli':96C 'block':76B 'bot':3A,29B,67B,95C,134C 'botconfig.allowed':157C,164C 'channel':9A,35B,70B,102C,137C,160C,165C 'configur':62B,98C,147C,171C 'content':176C 'correct':178C 'cve':11A,14A 'deni':40B,169C 'drop':179C 'enforc':30B 'even':71B,150C 'event':114C,124C,175C 'handler':47B,53B,115C,125C,184C 'issu':186C 'mention':5A,52B,65B,123C,132C 'messag':46B,113C,183C 'multi':81C 'multi-ag':80C 'normal':45B,111C,182C 'pair':107C 'patch':189C 'polici':41B,74B,108C,168C 'praisonai':1A,23B,26B,77C,92C,148C 'present':143C 'python':24B 'sender':153C 'skip':6A 'slack':2A,25B,28B,55B,94C,112C,121C,127C,140C 'system':84C 'team':83C 'therefor':59B 'tool':22B 'trigger':60B,145C 'unknown':38B,105C,166C 'unknown-us':37B,104C 'user':7A,33B,39B,57B,100C,106C,129C,158C,167C 'version':86C,90C,191C 'workspac':56B,128C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the PraisonAI Slack bot integration on a version from `3.11.0` before `4.6.59`. Any Slack workspace member who can mention the bot in a channel where the app is installed can reach the agent, so the exposure is the workspace membership rather than the public internet. Teams not using the Slack bot, or already on `4.6.59` or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56835","severity":null,"published_at":"2026-10-23T12:18:14+00:00","modified_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}