# OpenClaw Google Chat authorization bypass with mutable email principal

Source: https://junglewise.ai/threats/openclaw-google-chat-authorization-bypass-with-mutable-email-principal-7bec0f48  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-02-17

OpenClaw is a Google Chat integration library that uses allowlists to control which senders can trigger actions. The vulnerability allows an attacker with Google Workspace administrative access to reassign email addresses between accounts, bypassing authorization controls that rely on mutable email identifiers instead of immutable user IDs. This could enable unauthorized message relay or command execution if an allowlist mistakenly uses email addresses instead of the recommended immutable user identifiers.

Technologies: [clawdbot (npm)](https://junglewise.ai/threats/technologies/clawdbot), [Openclaw](https://junglewise.ai/threats/technologies/openclaw). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 17 February 2026.

**Which products and versions are affected?** clawdbot (npm) SEMVER:introduced=0,last_affected=2026.1.24-3; Openclaw <= 2026.2.13.

**Is there a fix for This vulnerability?** A patch was published on 2026-02-14: Fix committed (PR #16243, commit c8424bf); openclaw patched in v2026.2.14; clawdbot has no patched release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run clawdbot (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OpenClaw's Google Chat monitor (extensions/googlechat/src/monitor.ts) implements allowlist-based access control that accepts both immutable user IDs (users/&lt;id&gt;) and mutable email addresses (alice@example.com) as authorization criteria. Historically, the legacy format users/&lt;email&gt; was also treated as an email allowlist entry, but this is mutable at the IdP level. An attacker with Google Workspace administrative control can exploit this by reassigning an email address to a different underlying user account (different users/&lt;id&gt;), effectively bypassing authorization checks on deployments that rely on email-based allowlists. The fix deprecates the users/&lt;email&gt; format and clarifies that raw email allowlists remain supported while recommending immutable users/&lt;id&gt; for strict binding. Exploitation requires prior authentication as Google Chat and IdP-level administrative privilege, limiting practical risk to scenarios with chained failures.

## Affected products

- OpenClaw openclaw <= 2026.2.13
- OpenClaw clawdbot <= 2026.1.24-3

## Timeline

- 2026-02-17: disclosed: GHSA-chm2-m3w2-wcxm advisory published
- 2026-02-14: patched: Fix committed (PR #16243, commit c8424bf); openclaw patched in v2026.2.14; clawdbot has no patched release

## References

- [https://github.com/openclaw/openclaw/security/advisories/GHSA-chm2-m3w2-wcxm](https://github.com/openclaw/openclaw/security/advisories/GHSA-chm2-m3w2-wcxm)
- [https://github.com/openclaw/openclaw/pull/16243](https://github.com/openclaw/openclaw/pull/16243)

## Related threats

- [OpenClaw incorrect authorization in mcp.app.view method](https://junglewise.ai/threats/cve-2026-102807-openclaw-before-2026-9-4-contains-an-incorrect-authorization)
- [OpenClaw incorrect authorization in Gateway media root allowlist](https://junglewise.ai/threats/cve-2026-102806-openclaw-before-2026-9-5-contains-an-incorrect-authorization)
- [OpenClaw exec approval bypass in Google Meet node commands](https://junglewise.ai/threats/cve-2026-100599-openclaw-versions-2026-5-1-through-2026-7-0-fail-to-apply-the)
- [OpenClaw Signal approval reaction binding logic error](https://junglewise.ai/threats/cve-2026-100598-openclaw-npm-package-openclaw-before-2026-7-1-incorrectly-binds)
- [OpenClaw time-of-check time-of-use race condition in filesystem operations](https://junglewise.ai/threats/cve-2026-100597-openclaw-npm-package-openclaw-before-2026-7-1-is-vulnerable-to-a)