PT-2026-27238 · Openclaw · Openclaw
CVSS v3.1
4.6
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.26
Description
The software contains an authorization bypass issue in how group allowlist policies are evaluated. Specifically, the system incorrectly accepts sender identities from Direct Message (DM) pairing-store approvals. This allows attackers who have obtained DM pairing approval to bypass group allowlist checks and gain unauthorized access to groups.
Recommendations
Update to version 2026.2.26 or later.
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Openclaw