Incorrect authorization in OpenClaw - #VU135908
Published: June 30, 2026
Vulnerability identifier: #VU135908
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authorization checks.
The vulnerability exists due to incorrect authorization in the MS Teams allowFrom feature when processing lower-trust caller or configured input paths. A remote user can supply crafted input that binds to mutable display names to bypass authorization checks.
Only instances where the affected feature is enabled and reachable are vulnerable, and practical impact depends on whether lower-trust input can reach that path.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.5.12