Authorization Bypass in OpenClaw Feishu by OpenClaw
CVE-2026-62188

8.6HIGH

Key Information:

Vendor

Openclaw

Status
Feishu
Vendor
CVE Published:
13 July 2026

What is CVE-2026-62188?

OpenClaw Feishu versions 2026.6.6 and earlier exhibit an incorrect authorization flaw, where the permission tools may disregard per-account disablement settings. This allows entities with lower trust levels or specific input paths to execute actions without the requisite authorization or policy validations. The vulnerability is rectified in version 2026.6.9, and users are advised to upgrade promptly to ensure their security.

Affected Version(s)

feishu 0 < 2026.6.9

feishu 2026.6.9

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/openclaw-feishu-auth...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rex Liu (@rexpository)
.