Incorrect authorization in OpenClaw - CVE-2026-100540
Published: November 3, 2026
Vulnerability identifier: #VU158800
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100540
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read or modify Feishu resources using an identity the operator intended to revoke.
The vulnerability exists due to incorrect authorization in the Feishu model tools' default account selection when processing tool invocations without checking whether the selected account is disabled. A remote user can invoke a tool using the disabled default account's retained credentials to read or modify Feishu resources.
Exploitation requires a multi-account configuration with a disabled default account and an enabled sibling account that keeps the relevant tool family available. Available actions are limited by the disabled app's scopes and the enabled tool families.
Affected software
OpenClaw
How to mitigate CVE-2026-100540
Install security update from vendor's website.
OpenClaw - update to 2026.8.1