CVE-2026-100590CWE-863broken-access-control

CVE-2026-100590

Medium · published September 26, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice used by Talk responses for the configured provider, affecting configuration integrity without exposing credentials or granting additional host capabilities.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00177 · 6.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-26T07:17Z
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-5j27-v2pw-cj9m · [email protected]https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-voice-set · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 02:19Z
    OpenClaw before 2026.7.1 Authorization Bypass via voice set
    cvelistv5