CVE-2026-35630CWE-862

OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons

High · published May 29, 2026

CVSS v4.0
7.5
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-29T15:10Z
EPSS history
Timeline
  • 29 MAY 15:10Z
    OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons
    cvelistv5