PT-2026-27243 · Openclaw · Openclaw

Tdjackey · CVE-2026-32911 · Publicado 2026-03-23 · Atualizado 2026-03-23

NVD

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

OpenClaw versions 2026.2.22 prior to 2026.2.24 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks to dispatch unauthorized messages to downstream agents and tools.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-32911

Produtos afetados

Openclaw

Referências · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gw85-xp4q-5gp9 · Nota
• https://github.com/openclaw/openclaw/commit/0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5 · Correção
• https://github.com/openclaw/openclaw/commit/7655c0cb3a47d0647cbbf5284e177f90b4b82ddb · Correção
• https://vulncheck.com/advisories/openclaw-mar-authorization-bypass-in-synology-chat-plugin-via-empty-alloweduserids · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32911 · Nota de Segurança