PT-2026-31760

CVE-2026-35624

Published

2026-03-26

Updated

2026-04-10

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw contains a policy confusion vulnerability in room authorization. The issue occurs because the software matches colliding room names instead of stable room tokens. This allows attackers to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms by exploiting similarly named rooms.

Recommendations Update to version 2026.3.22 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-863: Incorrect Authorization

CWE-807: Reliance on Untrusted Inputs in a Security Decision