CVE-2026-100526: Missing Authorization in openclaw discord
CVE-2026-100526 is a medium severity vulnerability in the OpenClaw Discord integration npm package (@openclaw/discord) before version 2026.9.3. It involves missing authorization checks in emoji and sticker upload actions that can cause the system to read local files outside the permitted media roots. Exploitation requires specific permissions and knowledge of local file paths. The vulnerability does not allow arbitrary filesystem browsing or code execution. The issue is fixed in version 2026.9.3.
AI Analysis
Technical Summary
OpenClaw's Discord integration package versions before 2026.9.3 have a missing authorization issue affecting the emoji and sticker upload actions. A sender with permission to invoke these actions can bypass the sender-scoped media policy before loading a local file, causing OpenClaw to read bytes from a local file path that would normally be rejected by the configured media roots. This can lead to out-of-policy local file data being included in outbound emoji or sticker uploads. Exploitation requires access to guild asset actions and knowledge or derivation of a useful local path. The vulnerability does not permit unrestricted filesystem browsing or code execution. The issue is resolved in version 2026.9.3 of @openclaw/discord.
Potential Impact
An attacker with limited permissions (sender permitted to invoke emoji or sticker upload actions) can cause the application to read local files outside the allowed media roots and include their content in outbound uploads. This could lead to unauthorized disclosure of local file contents. However, the vulnerability does not allow arbitrary filesystem browsing or remote code execution.
Mitigation Recommendations
Upgrade to @openclaw/discord version 2026.9.3 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
CVE-2026-100526: Missing Authorization in openclaw discord
Description
CVE-2026-100526 is a medium severity vulnerability in the OpenClaw Discord integration npm package (@openclaw/discord) before version 2026.9.3. It involves missing authorization checks in emoji and sticker upload actions that can cause the system to read local files outside the permitted media roots. Exploitation requires specific permissions and knowledge of local file paths. The vulnerability does not allow arbitrary filesystem browsing or code execution. The issue is fixed in version 2026.9.3.
CVSS v4.0
Score 6.0medium
Affected software
openclaw
discord
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw's Discord integration package versions before 2026.9.3 have a missing authorization issue affecting the emoji and sticker upload actions. A sender with permission to invoke these actions can bypass the sender-scoped media policy before loading a local file, causing OpenClaw to read bytes from a local file path that would normally be rejected by the configured media roots. This can lead to out-of-policy local file data being included in outbound emoji or sticker uploads. Exploitation requires access to guild asset actions and knowledge or derivation of a useful local path. The vulnerability does not permit unrestricted filesystem browsing or code execution. The issue is resolved in version 2026.9.3 of @openclaw/discord.
Potential Impact
An attacker with limited permissions (sender permitted to invoke emoji or sticker upload actions) can cause the application to read local files outside the allowed media roots and include their content in outbound uploads. This could lead to unauthorized disclosure of local file contents. However, the vulnerability does not allow arbitrary filesystem browsing or remote code execution.
Mitigation Recommendations
Upgrade to @openclaw/discord version 2026.9.3 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T01:00:40.148Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab72eeef7a7c54106c273bb
Added to database: 09/26/2026, 02:33:18 UTC
Last enriched: 09/26/2026, 02:48:13 UTC
Last updated: 09/26/2026, 03:54:27 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.