# CVE-2026-62224: OpenClaw MS Teams authorization bypass in allowFrom feature

Source: https://junglewise.ai/threats/cve-2026-62224-openclaw-ms-teams-authorization-bypass-in-allowfrom-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-62224 · Severity: medium · CVSS 5.4 · Published 2026-07-17

OpenClaw MS Teams, a library used for integrating Microsoft Teams functionality, contains a security flaw in its 'allowFrom' authorization feature. The system incorrectly identifies users based on their display names, which can be changed by the users themselves, rather than using permanent, unique identifiers. This allows a user with low-level access to impersonate a more privileged user and perform unauthorized actions within the application.

Technologies: [Openclaw Msteams](https://junglewise.ai/threats/technologies/msteams). Vendors: [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is CVE-2026-62224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62224 being exploited in the wild.

**How severe is CVE-2026-62224?** Medium severity, with a CVSS score of 5.4, published 17 July 2026.

**Which products and versions are affected?** Openclaw Msteams < 2026.5.12.

**Is there a fix for CVE-2026-62224?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62224 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62224?** Check whether you run Openclaw Msteams at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass vulnerability exists in OpenClaw MS Teams (npm package @openclaw/msteams) prior to version 2026.5.12. The root cause is an incorrect authorization check (CWE-863) in the 'allowFrom' feature, which relies on mutable display names for identity verification rather than immutable identifiers. A remote attacker with low-privileged access can exploit this by spoofing a trusted display name (CWE-290) to bypass security policies and perform actions requiring higher authorization levels. The vulnerability is reachable over the network if the affected feature is enabled and exposed to lower-trust inputs. A patch is available in version 2026.5.12.

## Affected products

- OpenClaw msteams < 2026.5.12

## Timeline

- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD

## References

- [https://github.com/openclaw/openclaw/security/advisories/GHSA-7w4v-g4m6-j88v](https://github.com/openclaw/openclaw/security/advisories/GHSA-7w4v-g4m6-j88v)
- [https://www.vulncheck.com/advisories/openclaw-ms-teams-authorization-bypass](https://www.vulncheck.com/advisories/openclaw-ms-teams-authorization-bypass)

## Related threats

- [OpenClaw msteams token leakage in MS Teams outbound requests](https://junglewise.ai/threats/cve-2026-62213-openclaw-msteams-token-leakage-in-ms-teams-outbound-requests)