CVE-2026-100531

Name of the Vulnerable Software and Affected Versions @openclaw/slack versions prior to 2026.8.1

Description An authorization flaw exists in the Slack download-file handler. When a file lacks the share metadata required to verify its association with a requested conversation, the conversation-authorization check fails open. This allows an authenticated caller, even if restricted to a single conversation, to download file contents from outside that conversation's scope if they possess a file identifier, leading to data disclosure across configured conversation boundaries. This issue does not permit the listing of arbitrary Slack files or the bypass of Slack authentication.

Recommendations Update @openclaw/slack to version 2026.8.1.