PT-2026-99177 · Unknown · Openclaw/Feishu
CVE-2026-100540
·
Published
2026-09-26
·
Updated
2026-09-26
CVSS v4.0
7.6
High
| Vector | AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw Feishu versions prior to 2026.8.1
Description
The software fails to validate if a configured default account is disabled before selecting it for model tool operations. In multi-account configurations, this allows attackers to use a disabled default account that still retains credentials to read or modify Feishu resources via a revoked identity.
Recommendations
Update to version 2026.8.1 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openclaw/Feishu