PT-2026-30551

Published

2026-03-26

Updated

2026-03-26

Description by

CVSS 3.1

4.2

Medium

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

Nextcloud Talk room authorization matched on collidable room names instead of the stable room token, allowing policy confusion across similarly named rooms.

Affected Packages / Versions

Package: openclaw (npm)
Affected: < 2026.3.22
Fixed: >= 2026.3.22
Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

extensions/nextcloud-talk/src/inbound.ts now resolves allowlist policy from roomToken-backed room identity.
extensions/nextcloud-talk/src/policy.ts now keys room authorization on stable room tokens instead of display names.

OpenClaw thanks @zpbrent for reporting.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-807: Reliance on Untrusted Inputs in a Security Decision

Related identifiers

GHSA-XHQ5-45PM-2GJR