Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-35642

OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attackers can trigger reactions in mention-gated groups to enqueue agent-visible system events that should remain restricted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.3.25affected
  • 2026.3.25unaffected
pkg:npm/openclaw

References