CVE-2026-28474CWE-863broken-access-control

CVE-2026-28474

Critical · published March 6, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00898 · 59.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-06T03:16Z
Affected products (1)
ProductVersionsFixed in
openclaw/openclaw< 2026.2.62026.2.6
References (3)
https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d · [email protected]https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r · [email protected]https://www.vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing · [email protected]
EPSS history
Timeline
  • 05 MAR 21:59Z
    OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing
    cvelistv5