CVE-2026-26328CWE-284CWE-863

OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

Medium · published February 19, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00437 · 36.9th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-863 · Incorrect Authorization
Published
2026-02-19T23:04Z
EPSS history
Timeline
  • 19 FEB 23:04Z
    OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities
    cvelistv5