Improper access control in OpenClaw - #VU125228
Published: April 8, 2026
Vulnerability identifier: #VU125228
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: OpenClaw
Affected software:
OpenClaw
OpenClaw
Detailed vulnerability description
The vulnerability allows a remote user to trigger privileged component actions.
The vulnerability exists due to improper access control in extensions/discord/src/monitor/agent-components.ts when handling Discord component interactions. A remote user can send a crafted component interaction from a blocked context to trigger privileged component actions.
The issue occurs because guild and channel policy gates used for normal inbound messages were not consistently reapplied to component interactions.
Remediation
Install security update from vendor's website.