Executive brief
OpenClaw is a JavaScript framework for building web-based management interfaces. A vulnerability in the focus command allows authenticated users to change focus state beyond their intended authority, potentially enabling unauthorized operations depending on gateway configuration and access controls. The impact is limited to scenarios where the affected feature is enabled and exposed to lower-trust callers.
Technical details
This is a missing authorization enforcement vulnerability (CWE-862) in OpenClaw's focus command. The vulnerable component fails to properly validate the controlScope when executing the focus command, allowing an authenticated caller to bypass intended access restrictions. An attacker with local or adjacent network access and valid authentication credentials can trigger the focus command to change focus state outside their intended authority. The vulnerability affects versions up to 2026.4.24; patch version 2026.4.25 addresses the control scope enforcement issue.
Affected products
- OpenClaw OpenClaw <=2026.4.24
Timeline
- 2026-05-28: disclosed
- 2026-04-25: patched: Version 2026.4.25 contains the fix