PT-2026-28451 · Openclaw+1 · Openclaw+1
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.11
Description
The software contains an authorization bypass issue in how Discord guild reactions are processed. Specifically, the system does not properly verify if a user or role is on an allowlist, allowing unauthorized users to trigger reaction events. These events are then incorrectly treated as trusted system events, potentially allowing injection of reaction text into session context.
Recommendations
Update to version 2026.3.11 or later.
Exploit
Correção
Improper Access Control
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Discord
Openclaw