← Database

CVE-2026-32021

MEDIUM CVSS: 6.5 Published: 2026-03-19 Modified: 2026-06-17

Description

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender display names instead of enforcing ID-only matching. An attacker can set a display name equal to an allowlisted ID string to bypass authorization checks and gain unauthorized access.

Affected Platforms

Openclaw Openclaw

Weakness Type

CWE-863

References