CVE-2026-32028
MEDIUMOpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress
Title source: cnaDescription
OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowlisted users to enqueue reaction-derived system events. Attackers can exploit this inconsistency by reacting to bot-authored DM messages to bypass DM authorization restrictions and trigger downstream automation or tool policies.
References (3)
Core 3
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-354r-7mfh-7rh2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-354r-7mfh-7rh2
Patch patch
Patch Commit
https://github.com/openclaw/openclaw/commit/aedf62ac7e669a89c7b299201bf6537dc6b12e0e
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress
https://www.vulncheck.com/advisories/openclaw-missing-authorization-check-in-discord-dm-reaction-ingress
Scores
CVSS v3
5.3
EPSS
0.0020
EPSS Percentile
9.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-863
Status
published
Products (4)
npm/openclaw
0 - 2026.2.25npm
OpenClaw/OpenClaw
< 2026.2.25
openclaw/openclaw
< 2026.2.25
OpenClaw/OpenClaw
2026.2.25
Published
Mar 19, 2026
Tracked Since
Mar 20, 2026