Incorrect authorization in OpenClaw - CVE-2026-32923
Published: April 8, 2026
Vulnerability identifier: #VU125141
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-32923
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject reaction text into downstream session context.
The vulnerability exists due to incorrect authorization in Discord guild reaction ingress when handling reaction events for guild channels. A remote user can send a reaction from a non-allowlisted guild member account to inject reaction text into downstream session context.
Accepted reactions are queued as trusted system events for the target session.
Affected software
OpenClaw
How to mitigate CVE-2026-32923
Install security update from vendor's website.
OpenClaw - update to 2026.3.11