CVE-2026-62196CWE-863broken-access-control

CVE-2026-62196

High · published July 14, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00396 · 32.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-14T02:16Z
Affected products (1)
ProductVersionsFixed in
openclaw/openclaw≥ 2026.3.22, < 2026.6.62026.6.6
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-fh38-965w-f6c3 · [email protected]https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-whatsapp-group-ids · [email protected]
EPSS history
Timeline
  • 13 JUL 21:30Z
    OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs
    cvelistv5