Executive brief
OpenClaw is a communication platform used for organizing channels and direct messaging. A vulnerability in cite (reference) expansion allowed content to be accessed or processed before completing authorization checks for channel and DM access, potentially exposing private conversations or allowing unauthorized content manipulation before security validations were enforced.
Technical details
This is an authorization bypass vulnerability (CWE-863) where cite expansion processing occurred before channel and DM authorization checks were completed. The vulnerable component in extensions/tlon/src/monitor/index.ts performed cite expansion work and content handling prematurely, before final authorization decisions could be validated. An unauthenticated or lower-privileged network attacker could exploit this timing window to access or manipulate content from protected channels or direct messages. The vulnerability affected all versions before 2026.3.22, which deferred cite expansion until after authorization checks were completed.
Affected products
- Tlon OpenClaw before 2026.3.22
Timeline
- 2026-03-24: disclosed
- 2026-03-22: patched: Fixed in version 2026.3.22