NPM: OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

NPM: OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...

CVE-2026-32976 OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels..accounts...

PT-2026-27153

Summary In affected versions of openclaw, channel-initiated config mutations were authorized against the originating account's configWrites policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration...