GitHub Advisoryadvisory · npm

GHSA-m69h-jm2f-2pv8 OpenClaw: Feishu reaction events could bypass group authorization and mention gating

MEDIUM Published 2026-03-13 Modified 2026-03-13 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-285, CWE-863
Reviewed
2026-03-13

Affected packages

• npm openclaw: < 2026.3.12 → fixed in 2026.3.12

Description

Summary A Feishu reaction-originated synthetic event could misclassify a group conversation as `p2p` when the inbound reaction payload omitted `chat_type`. Authorization and mention-gating logic keyed off that incorrect chat type and evaluated the event as a direct message instead of a group message. Impact This could bypass `groupAllowFrom` and `requireMention` protections for reaction-derived events in Feishu group chats. Affected versions `openclaw` `<= 2026.3.11` Patch Fixed in `openclaw` `2026.3.12`. Reaction events now preserve the correct group context before authorization and mention-gate evaluation. Users should update to `2026.3.12` or later.

Related

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References