CVE-2026-41381CWE-863

OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist

Low · published April 28, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests before channel allowlist authorization is performed, gaining unauthorized access to restricted voice channels.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist
    cvelistv5