Executive brief
OpenClaw is a messaging integration framework that handles webhooks for Synology Chat, a business communication platform. A vulnerability in webhook path handling allows attackers to collapse multi-account configurations onto shared paths, bypassing per-account access control policies and potentially exposing private messages across accounts.
Technical details
The vulnerability is an improper authorization issue (CWE-285) in OpenClaw's Synology Chat extension where webhook path routing can be compromised through path collision. Multi-account configurations can collapse onto a shared webhook path, causing route ownership replacement and bypassing per-account DM access control policies. The attack is network-accessible with high complexity (AC:H) and requires no authentication. An attacker can exploit inherited or duplicate webhook paths to access private messages across different account contexts. The fix, released in version 2026.3.22, distinguishes inherited base paths from explicit per-account paths and fails closed on path collisions.
Affected products
- OpenClaw OpenClaw before 2026.3.22
Timeline
- 2026-03-24: disclosed: Advisory GHSA-rqp8-q22p-5j9q published by OpenClaw maintainer
- 2026-03-22: patched: Fix released in version 2026.3.22
- 2026-04-10: other: Duplicate advisory GHSA-g8mc-c5f2-mqg7 withdrawn