https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T22:46:10.871869+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-32972 CVE-2026-32972 — OpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.request 2026-09-30T22:46:10.873716+00:00

Affected: OpenClaw

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist attacker-controlled remote CDP endpoints to disk without holding operator.admin privileges.

 https://db.gcve.eu/vuln/ghsa-vmhq-cqm9-6p7q GHSA-vmhq-cqm9-6p7q — OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes 2026-09-30T22:46:10.873803+00:00

Affected: npm: openclaw

### Summary

An authorization mismatch in the gateway let an authenticated caller with only `operator.write` use `browser.request` to reach browser profile management routes that persist configuration to disk. In practice, this exposed an admin-only configuration write primitive through `/profiles/create`.

### Impact

A write-scoped operator could create or modify browser profiles and store attacker-chosen remote CDP endpoints without holding `operator.admin`.

### Affected versions

`openclaw` `<= 2026.3.8`

### Patch

Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Browser profile creation now requires the correct admin boundary, and regression tests cover the write-vs-admin authorization split.