https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 08:03:59 +0000 https://db.gcve.eu/vuln/cve-2026-56835 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI&#39;s Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy=&#34;deny&#34; is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI&#39;s Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy=&#34;deny&#34; is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.</p> https://db.gcve.eu/vuln/cve-2026-56835