GitHub Advisoryadvisory · npm

GHSA-v8cg-4474-49v8 OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers

MEDIUM Published 2026-03-12 Modified 2026-03-30 Official page ↗
Aliases
CVE-2026-32895
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-03-12

Affected packages

• npm openclaw: < 2026.2.26 → fixed in 2026.2.26

Description

Summary Slack `member_*` and `message` subtype system events (`message_changed`, `message_deleted`, `thread_broadcast`) were not consistently enforcing sender authorization before enqueueing system events. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published version: `2026.2.25` • Affected range: `= 2026.2.26` so once npm `2026.2.26` is published, this advisory can be published without further field edits. Thanks @tdjackey for reporting.

Related

Alias · CVE (1)

  • CVE-2026-32895 OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References