PT-2026-31776 · Openclaw · Openclaw
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.25
Description
OpenClaw contains an authorization bypass issue where group reaction events circumvent the
requireMention access control. This allows attackers to trigger reactions in groups that require a mention, leading to the enqueueing of system events that should be restricted to agent visibility.Recommendations
Update to version 2026.3.25 or later.
Exploit
Fix
Incorrect Authorization
Authentication Bypass Using an Alternate Path or Channel
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw