CVE-2026-32975CWE-807

OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist

Medium · published March 29, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist
    cvelistv5