PT-2026-26402 · Openclaw · Openclaw

Jisung

·

Published

2026-03-03

·

Updated

2026-03-20

·

CVE-2026-32021

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22
Description OpenClaw versions before 2026.2.22 contain an authorization bypass in the Feishu allowFrom allowlist implementation. The system accepts mutable sender display names instead of enforcing matching based on ID only. An attacker can set a display name equal to an allowlisted ID string to bypass authorization checks and gain unauthorized access. The channels.feishu.allowFrom feature is documented as an ID-based allowlist, but it accepted mutable sender display names. This allowed an attacker to use a display name that matched an allowed ID, bypassing authorization. The fix enforces ID-only matching for Feishu allowlist checks, normalizes Feishu ID prefixes during comparison, and ignores mutable display names for authorization. Deployments using Feishu allowlist-based authorization could incorrectly authorize non-allowlisted senders when a colliding display name was used.
Recommendations Update OpenClaw to version 2026.2.22 or later.

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639CWE-863

Related Identifiers

CVE-2026-32021
GHSA-J4XF-96QF-RX69

Affected Products

Openclaw