CVE-2026-56832

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.2 through 4.6.58

Description The praisonai.bots.DiscordApproval component improperly handles approval requests for dangerous tool calls. It approves a pending request if any non-bot message containing approval text, such as yes, is posted in the configured Discord channel after the approval request, regardless of whether the message is a direct reply or tied to the specific request. This lack of request binding allows any user with write access to the channel to authorize high-risk operations. Additionally, the Slack and Telegram approval backends lack an explicit approver allowlist. An attacker can exploit this to trigger privileged operations, potentially leading to code execution, file modification, or unauthorized data access with the privileges of the PraisonAI process. The issue occurs in the poll for response() function, which polls the endpoint /channels/{channel id}/messages?after={message id}&limit=10 and approves the request based on the content of subsequent messages without verifying the sender's identity or the message's relationship to the request.

Recommendations For versions 4.5.2 through 4.6.58: