Executive brief
OpenClaw is a messaging/communication application that allows authorized users to manage sender allowlists across multiple accounts. A flaw in the /allowlist --store command caused authorization rules intended for one account to be stored unscoped, silently applying them to the default account as well. This allows an already-authorized user to unintentionally expand sender permissions across accounts.
Technical details
The vulnerability is an incorrect authorization scoping bug (CWE-639, CWE-863) in the /allowlist command's --store functionality. The code resolved the target accountId for read operations but failed to pass that accountId during write operations to the pairing allowlist store, causing entries to be written to a legacy unscoped store instead. Because default-account reads still merge legacy unscoped entries, an allowlist modification intended for one account would silently authorize the same sender on the default account. Exploitation requires an already-authorized user with permission to run /allowlist edits. The fix, released in version 2026.3.7 (March 8, 2026), scopes all store writes by account and clears legacy default-account entries to eliminate the cross-account bleed-through.
Affected products
- OpenClaw openclaw <= 2026.3.2
Timeline
- 2026-03-09: disclosed: GHSA-pjvx-rx66-r3fg published
- 2026-03-07: patched: Fix committed to main branch (70da80bcb5574a10925469048d2ebb2abf882e73)
- 2026-03-08: patched: Patched release 2026.3.7 published on npm