Executive brief
OpenClaw is a Discord bot library that handles moderation actions such as timeouts, kicks, and bans. The vulnerability allows non-admin users to forge moderation commands by spoofing sender identity fields, potentially enabling unauthorized account restrictions or removals from Discord servers where the bot is active and has moderation permissions.
Technical details
The vulnerability is a missing authorization check (CWE-862) where Discord moderation action handling extracted sender identity from untrusted request parameters rather than from the trusted runtime context. An attacker authenticated to the Discord server could forge tool-driven moderation flow requests with spoofed sender identities to bypass authorization checks and execute timeout, kick, or ban actions without proper permissions. The fix implements trusted sender context validation (requesterSenderId) and adds guild permission verification per action. The issue affects all versions prior to 2026.2.18.
Affected products
- OpenClaw OpenClaw <=2026.2.17
Timeline
- 2026-02-20: disclosed: GHSA-wh94-p5m6-mr7j published
- 2026-02-21: advisory: CVE-2026-27484 assigned
- 2026-02-18: patched: Fix released in version 2026.2.18