CVE-2026-62224CWE-290CWE-863broken-access-control

CVE-2026-62224

Medium · published July 17, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Weaknesses
CWE-290 · Authentication Bypass by Spoofing; CWE-863 · Incorrect Authorization
Published
2026-07-17T06:18Z
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-7w4v-g4m6-j88v · [email protected]https://www.vulncheck.com/advisories/openclaw-ms-teams-authorization-bypass · [email protected]
EPSS history
Timeline
  • 17 JUL 00:07Z
    OpenClaw MS Teams < 2026.5.12 Authorization Bypass
    cvelistv5