42 matches found
CVE-2026-62224
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
CVE-2026-62224 OpenClaw MS Teams < 2026.5.12 Authorization Bypass
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
CVE-2026-62224
OpenClaw MS Teams before version 2026.5.12 has an authorization bypass where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization due to this binding. The description specifies the vulnerability exists prior t...
EUVD-2026-45112
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
CVE-2026-62224
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
CVE-2026-62224 OpenClaw MS Teams < 2026.5.12 Authorization Bypass
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
CVE-2026-62224 OpenClaw MS Teams < 2026.5.12 Authorization Bypass
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
PT-2026-60634
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
NPM: OpenClaw: Matrix allowFrom could bind to mutable display names
NPM: OpenClaw: Matrix allowFrom could bind to mutable display names vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.6...
OpenClaw: Matrix allowFrom could bind to mutable display names
Summary Matrix allowFrom could bind to mutable display names. In affected versions, a Matrix account able to change display name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...
PT-2026-55376
Summary Matrix allowFrom could bind to mutable display names. In affected versions, a Matrix account able to change display name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...
NPM: OpenClaw: Discord allowFrom could bind to mutable display names
NPM: OpenClaw: Discord allowFrom could bind to mutable display names vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.6...
EUVD-2026-37151
OpenClaw: Discord allowFrom could bind to mutable display names...
GHSA-CW4Q-GQG5-G38H OpenClaw: Discord allowFrom could bind to mutable display names
Summary Discord allowFrom could bind to mutable display names. In affected versions, a Discord account able to change display or global name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change...
OpenClaw: Discord allowFrom could bind to mutable display names
Summary Discord allowFrom could bind to mutable display names. In affected versions, a Discord account able to change display or global name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change...
NPM: OpenClaw: Zalo allowFrom could bind to mutable display names
NPM: OpenClaw: Zalo allowFrom could bind to mutable display names vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.2...
User Impersonation
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Impersonation via the allowFrom process. An attacker can access agent responses intended for another identity by leveraging mutable display metadata to match policy entries...
GHSA-8C59-HR4W-QG69 OpenClaw: Zalo allowFrom could bind to mutable display names
Summary Zalo allowFrom could bind to mutable display names. In affected versions, a Zalo friend or contact with mutable display metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...
User Impersonation
Overview @openclaw/zalo is an OpenClaw Zalo channel plugin Affected versions of this package are vulnerable to User Impersonation via the allowFrom process. An attacker can access agent responses intended for another identity by leveraging mutable display metadata to match policy entries...