Improper access control in OpenClaw - #VU135910
Published: June 30, 2026
Vulnerability identifier: #VU135910
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authorization checks and perform unauthorized actions.
The vulnerability exists due to improper access control in the browser act route when handling current-tab URL checks. A remote user can invoke the affected route through a lower-trust caller or configured input path to bypass authorization checks and perform unauthorized actions.
Exploitation requires the affected feature to be enabled and reachable, and practical impact depends on whether lower-trust input can reach that path.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.5.19