Summary
PraisonAI's Discord approval backend may approve a pending dangerous tool call when any later message in the configured channel contains approval-like text, such as "yes." An attacker who can post in that channel could cause a high-risk action to run without being the intended approver or replying to the specific request.
PraisonAI's Discord approval backend may approve a pending dangerous tool call when any later message in the configured channel contains approval-like text, such as "yes." An attacker who can post in that channel could cause a high-risk action to run without being the intended approver or replying to the specific request.
Affected context
The issue affects PraisonAI deployments using the DiscordApproval backend in versions where approval messages are correlated only by channel activity and approval-like text. The approving message does not need to be a reply to the pending request, and channel participants may therefore influence approval decisions when they can post in the configured approval channel. Related messaging backends may also require explicit controls to ensure that only authorized approvers can approve actions.
The issue affects PraisonAI deployments using the DiscordApproval backend in versions where approval messages are correlated only by channel activity and approval-like text. The approving message does not need to be a reply to the pending request, and channel participants may therefore influence approval decisions when they can post in the configured approval channel. Related messaging backends may also require explicit controls to ensure that only authorized approvers can approve actions.
Exploit preconditions
- Attack surface: A configured Discord channel used for tool-call approvals
- Required access: Ability to send messages in that approval channel
- Trigger point: A pending dangerous or high-risk tool call followed by an approval-like message
- Why exploitation is possible: The backend accepts qualifying later channel messages without reliably binding approval to the original request, thread, or authorized approver
- Attack surface: A configured Discord channel used for tool-call approvals
- Required access: Ability to send messages in that approval channel
- Trigger point: A pending dangerous or high-risk tool call followed by an approval-like message
- Why exploitation is possible: The backend accepts qualifying later channel messages without reliably binding approval to the original request, thread, or authorized approver
Why this happens
The underlying bug is an authorization and request-correlation failure. The Discord approval logic treats a later message with approval-like content as sufficient authorization, even when the sender is not an approved decision-maker and the message is unrelated to the pending request. This behavior maps primarily to CWE-863: Incorrect Authorization and is also consistent with CWE-345: Insufficient Verification of Data Authenticity, because the approval signal is not adequately authenticated or bound to its intended source and request.
The underlying bug is an authorization and request-correlation failure. The Discord approval logic treats a later message with approval-like content as sufficient authorization, even when the sender is not an approved decision-maker and the message is unrelated to the pending request. This behavior maps primarily to CWE-863: Incorrect Authorization and is also consistent with CWE-345: Insufficient Verification of Data Authenticity, because the approval signal is not adequately authenticated or bound to its intended source and request.
Potential impact
- An unauthorized user could approve a pending high-risk tool call
- Sensitive data could be accessed, modified, or disclosed by the approved tool
- External services or infrastructure could be changed
- Automated workflows could perform unintended destructive or costly actions
- The incident could undermine confidence in human-in-the-loop controls
- An unauthorized user could approve a pending high-risk tool call
- Sensitive data could be accessed, modified, or disclosed by the approved tool
- External services or infrastructure could be changed
- Automated workflows could perform unintended destructive or costly actions
- The incident could undermine confidence in human-in-the-loop controls
General mitigation guidance
Mitigation generally focuses on making approval decisions explicit, authenticated, and request-bound.
Defensive patterns include:
- Restricting approvals to a defined allowlist of trusted users or roles
- Binding each approval to a unique request, thread, nonce, or confirmation token
- Requiring the approver identity and approval event to match the pending action
- Rejecting unrelated channel messages and ambiguous approval text
- Applying least privilege to tools, credentials, and downstream integrations
- Recording immutable audit details for requests, approvers, and approval outcomes
- Applying equivalent authorization controls consistently across Discord, Slack, and Telegram backends
Mitigation generally focuses on making approval decisions explicit, authenticated, and request-bound.
Defensive patterns include:
- Restricting approvals to a defined allowlist of trusted users or roles
- Binding each approval to a unique request, thread, nonce, or confirmation token
- Requiring the approver identity and approval event to match the pending action
- Rejecting unrelated channel messages and ambiguous approval text
- Applying least privilege to tools, credentials, and downstream integrations
- Recording immutable audit details for requests, approvers, and approval outcomes
- Applying equivalent authorization controls consistently across Discord, Slack, and Telegram backends
How teams detect issues like this
Detection can combine static analysis, code review, runtime monitoring, and policy enforcement:
- Search for approval handlers that scan broad channel history or accept text-only approval signals
- Review whether approval events are bound to a request identifier, thread, sender identity, and expiration window
- Flag integrations lacking explicit approver allowlists or role checks
- Monitor audit logs for approvals from users outside the authorized group or for approvals not associated with a specific request
- Add automated tests for unrelated messages, cross-user approvals, replayed approvals, and concurrent pending requests
- Use automated code-review or policy tools to identify authorization decisions based solely on message content
Detection can combine static analysis, code review, runtime monitoring, and policy enforcement:
- Search for approval handlers that scan broad channel history or accept text-only approval signals
- Review whether approval events are bound to a request identifier, thread, sender identity, and expiration window
- Flag integrations lacking explicit approver allowlists or role checks
- Monitor audit logs for approvals from users outside the authorized group or for approvals not associated with a specific request
- Add automated tests for unrelated messages, cross-user approvals, replayed approvals, and concurrent pending requests
- Use automated code-review or policy tools to identify authorization decisions based solely on message content
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
