CVE-2026-53807CWE-863

OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

High · published June 11, 2026

CVSS v4.0
7.7
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied, triggering command behavior outside configured Telegram sender restrictions.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-06-11T20:05Z
EPSS history
Timeline
  • 11 JUN 20:05Z
    OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom
    cvelistv5