PT-2026-28451 · Openclaw+1 · Openclaw+1

Peng Zhou · Published 2026-03-29 · Updated 2026-03-29 · CVE-2026-32923

Positive Technologies · (AI Summary)

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description The software contains an authorization bypass issue in how Discord guild reactions are processed. Specifically, the system does not properly verify if a user or role is on an allowlist, allowing unauthorized users to trigger reaction events. These events are then incorrectly treated as trusted system events, potentially allowing injection of reaction text into session context.

Recommendations Update to version 2026.3.11 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-32923

Affected Products

Discord

Openclaw

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32923 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9vvh-2768-c8vp · Note
• https://vulncheck.com/advisories/openclaw-authorization-bypass-in-discord-guild-reaction-allowlist-enforcement · Note
• https://twitter.com/CVEnew/status/2038250154701000998 · Twitter Post