https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 13:10:31 +0000 https://db.gcve.eu/vuln/cve-2026-32924 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.</p> https://db.gcve.eu/vuln/cve-2026-32924 https://db.gcve.eu/vuln/ghsa-m69h-jm2f-2pv8 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>A Feishu reaction-originated synthetic event could misclassify a group conversation as `p2p` when the inbound reaction payload omitted `chat_type`. Authorization and mention-gating logic keyed off that incorrect chat type and evaluated the event as a direct message instead of a group message.</p> <p>### Impact</p> <p>This could bypass `groupAllowFrom` and `requireMention` protections for reaction-derived events in Feishu group chats.</p> <p>### Affected versions</p> <p>`openclaw` `&lt;= 2026.3.11`</p> <p>### Patch</p> <p>Fixed in `openclaw` `2026.3.12`. Reaction events now preserve the correct group context before authorization and mention-gate evaluation. Users should update to `2026.3.12` or later.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>A Feishu reaction-originated synthetic event could misclassify a group conversation as `p2p` when the inbound reaction payload omitted `chat_type`. Authorization and mention-gating logic keyed off that incorrect chat type and evaluated the event as a direct message instead of a group message.</p> <p>### Impact</p> <p>This could bypass `groupAllowFrom` and `requireMention` protections for reaction-derived events in Feishu group chats.</p> <p>### Affected versions</p> <p>`openclaw` `&lt;= 2026.3.11`</p> <p>### Patch</p> <p>Fixed in `openclaw` `2026.3.12`. Reaction events now preserve the correct group context before authorization and mention-gate evaluation. Users should update to `2026.3.12` or later.</p> https://db.gcve.eu/vuln/ghsa-m69h-jm2f-2pv8