GitHub Advisoryadvisory · npm

GHSA-wv46-v6xc-2qhf OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

MEDIUM Published 2026-03-26 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-35670
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-639, CWE-706, CWE-807
Reviewed
2026-03-26

Affected packages

• npm openclaw: < 2026.3.22 → fixed in 2026.3.22

Description

Summary Synology Chat reply delivery could rebind to a mutable username match instead of the stable numeric user_id recorded by the webhook event. Affected Packages / Versions • Package: `openclaw` (npm) • Affected: = 2026.3.22 • Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) • Latest published npm version checked: `2026.3.23-2` Fix Commit(s) • `7ade3553b74ee3f461c4acd216653d5ba411f455` Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`. Code-Level Confirmation • extensions/synology-chat/src/webhook-handler.ts now keeps replies bound to the stable webhook user identifier unless an explicit dangerous opt-in is enabled. • extensions/synology-chat/src/config-schema.ts contains the explicit dangerous opt-in seam instead of silent username rebinding. OpenClaw thanks @nexrin for reporting.

Related

Alias · CVE (1)

  • CVE-2026-35670 OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users… vulnerability

Weakness · CWE (3)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-706 Use of Incorrectly-Resolved Name or Reference weakness
  • CWE-807 Reliance on Untrusted Inputs in a Security Decision weakness

References