PraisonAI Slack app_mention bypasses configured user/channel authorization
Date: 2026-06
Affected: pip/praisonai
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CWE: CWE-862
CWE-863
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)

# PraisonAI Slack `app_mention` bypasses configured user/channel authorization ## Summary PraisonAI's Slack bot applies its configured `allowed_users`, `allowed_channels`, and unknown-user pairing policy in the normal Slack `message` event handler, but not in the adjacent Slack `app_mention` event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: - the sender is not in `BotConfig.allowed_users`; - the channel is not in `BotConfig.allowed_channels`; - `unknown_user_policy="deny"` is configured; and - the same event content is correctly dropped by the normal `message` handler. This is a sibling-handler guard-coverage issue. Slack documents `app_mention` as a distinct event type rather than a `message.*` event, so deployments subscribed to app mentions can route unauthorized sender input around the guarded message path. ## Affected product - Repository: `MervinPraison/PraisonAI` - Package: `praisonai` - Component: `src/praisonai/praisonai/bots/slack.py` - Configuration component: `src/praisonai-agents/praisonaiagents/bots/config.py` Confirmed affected: ```text v3.11.0 7f37d754a72511a71f7eeaaa8e9f367a5dc45fd8 v3.11.14 44b800df0eddf32dd5242f47da7513e4a3159d76 v3.12.0 51f95ad904a6616b35caede1cd74026ec8f7152c v4.4.5 9a3363c900fa3be3fce5483be7f6c1f418757ebb v4.4.6 90b00f9a25ee5c7ccf4b6ab3152700e1881f262d v4.4.12 7d0657632fc477673153ad116cecf692b454bfa3 v4.5.2 8ddb


Mitigations:

Architectural layers (MAESTRO):