PraisonAI (>= 4.5.112, < 4.6.59) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/praisonai--4.5.112--4.6.59/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 13:40:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPraisonAI: Authorization bypass in approval backends (CVE-2026-56832)https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/Fri, 23 Oct 2026 13:40:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/PraisonAI versions 4.5.2 to before 4.6.59 contain an authorization bypass vulnerability in Discord, Slack, and Telegram approval backends, allowing unauthorized users to approve high-risk multi-agent tool calls.PraisonAI, a multi-agent teams system, contains an authorization bypass vulnerability (CVE-2026-56832) affecting versions 4.5.2 to before 4.6.59. The issue involves the Discord, Slack, and Telegram messaging approval backends. In the Discord backend, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending "yes" because the system does not require the message to be a reply or request-bound. Slack and Telegram backends lack an explicit approver allowlist parameter. This issue was patched in version 4.6.59.

]]>highadvisoryauthentication-bypassapi-securitypraisonaipath-traversalvulnerabilityfile-deletion