https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 07:33:55 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-35620 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>&gt; Fixed in OpenClaw 2026.3.24, the current shipping release.</p> <p>**Title** Non-owner command-authorized sender can change the owner-only `/send` session delivery policy</p> <p>**CWE** CWE-285 Improper Authorization</p> <p>**CVSS v3.1** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Base score: **5.4 (Medium)**</p> <p>**Severity Assessment** Medium. This is a real owner-only authorization bypass, but the demonstrated impact is limited to persistent mutation of the current session’s delivery policy rather than direct code execution, sandbox escape, or cross-host compromise.</p> <p>**Impact** A non-owner sender who is allowed to run commands can invoke `/send on|off|inherit` and persistently change the current session’s `sendPolicy`, even though OpenClaw documents `/send` as owner-only.</p> <p>That lets a lower-trust participant: - disable reply delivery for the current session (`/send off`), suppressing future replies in that chat; - re-enable reply delivery (`/send on`) after the owner intentionally disabled it; - remove the session override (`/send inherit`).</p> <p>**Affected Component** Verified against the latest published GitHub release tag `v2026.3.23` (`ccfeecb6887cd97937e33a71877ad512741e82b2`), published `2026-03-23T23:15:50Z`.</p> <p>Exact vulnerable path on the shipped tag: - `src/auto-reply/reply/commands-session.ts:212-239` - `handleSendPolicyCommand(...)` checks only `params.command.isAuthorizedSender`. - when true, it mutates `params.sessionEntry.sendPolicy` and persists the session entry.…</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>&gt; Fixed in OpenClaw 2026.3.24, the current shipping release.</p> <p>**Title** Non-owner command-authorized sender can change the owner-only `/send` session delivery policy</p> <p>**CWE** CWE-285 Improper Authorization</p> <p>**CVSS v3.1** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Base score: **5.4 (Medium)**</p> <p>**Severity Assessment** Medium. This is a real owner-only authorization bypass, but the demonstrated impact is limited to persistent mutation of the current session’s delivery policy rather than direct code execution, sandbox escape, or cross-host compromise.</p> <p>**Impact** A non-owner sender who is allowed to run commands can invoke `/send on|off|inherit` and persistently change the current session’s `sendPolicy`, even though OpenClaw documents `/send` as owner-only.</p> <p>That lets a lower-trust participant: - disable reply delivery for the current session (`/send off`), suppressing future replies in that chat; - re-enable reply delivery (`/send on`) after the owner intentionally disabled it; - remove the session override (`/send inherit`).</p> <p>**Affected Component** Verified against the latest published GitHub release tag `v2026.3.23` (`ccfeecb6887cd97937e33a71877ad512741e82b2`), published `2026-03-23T23:15:50Z`.</p> <p>Exact vulnerable path on the shipped tag: - `src/auto-reply/reply/commands-session.ts:212-239` - `handleSendPolicyCommand(...)` checks only `params.command.isAuthorizedSender`. - when true, it mutates `params.sessionEntry.sendPolicy` and persists the session entry.…</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-35620 https://db.gcve.eu/vuln/cve-2026-35620 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy settings, and the /allowlist mutating commands fail to enforce operator.admin scope. Attackers with operator.write scope can invoke /send on|off|inherit to persistently mutate the current session&#39;s sendPolicy, and execute /allowlist add commands to modify config-backed allowFrom entries and pairing-store allowlist entries without proper admin authorization.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy settings, and the /allowlist mutating commands fail to enforce operator.admin scope. Attackers with operator.write scope can invoke /send on|off|inherit to persistently mutate the current session&#39;s sendPolicy, and execute /allowlist add commands to modify config-backed allowFrom entries and pairing-store allowlist entries without proper admin authorization.</p> https://db.gcve.eu/vuln/cve-2026-35620