PraisonAI Slack authorization bypass via app_mention event

Executive brief

PraisonAI is an AI agent framework that can be integrated with Slack to automate tasks. A security flaw in its Slack integration allows unauthorized users to bypass configured security restrictions by mentioning the bot directly. This means an unapproved user could interact with the AI agent and potentially trigger sensitive tools or access data, even if they are explicitly blocked in the bot's configuration.

Technical details

A sibling-handler guard-coverage issue exists in the PraisonAI Slack bot implementation. While the 'message' event handler correctly enforces 'allowed_users', 'allowed_channels', and 'unknown_user_policy' configurations, the 'app_mention' event handler in 'src/praisonai/praisonai/bots/slack.py' lacks these checks. An attacker within the same Slack workspace can bypass authorization by mentioning the bot in a channel where it is present. This allows the attacker to invoke the agent session and any associated tools (e.g., file access, scheduling, web search) without being on the allowlist. The vulnerability is addressed in version 4.6.59.

Affected products

• MervinPraison praisonai >= 3.11.0, <= 4.6.58

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory: GHSA-qvpf-j64c-jmhr published
• 2026-06-18: patched: Version 4.6.59 released

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D