CVE-2026-100582: Missing Authorization in openclaw msteams
OpenClaw channel plugins including @openclaw/msteams before version 2026.8.1 have a missing authorization vulnerability. This flaw allows lower-trust senders or agents with channel read access to bypass the configured read allowlist and access content or metadata from channels or rooms that should be restricted. The vulnerability affects message, reaction, pin, member, and related metadata read actions. The issue is resolved in version 2026.8.1.
AI Analysis
Technical Summary
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) prior to 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets. This missing authorization allows a lower-trust sender or a steered agent with channel read permissions to retrieve content or metadata from channels or rooms excluded by the operator's read policy. The impact depends on the permissions of the connected bot account. The vulnerability is fixed in version 2026.8.1.
Potential Impact
An attacker or lower-trust user with channel read action access can bypass read restrictions and access unauthorized channel content or metadata. The severity is high with a CVSS 4.0 score of 7.1, indicating significant confidentiality impact without requiring user interaction or elevated privileges beyond low privileges.
Mitigation Recommendations
Upgrade OpenClaw channel plugins to version 2026.8.1 or later, where the missing authorization issue has been fixed. No additional mitigation is required once the update is applied.
CVE-2026-100582: Missing Authorization in openclaw msteams
Description
OpenClaw channel plugins including @openclaw/msteams before version 2026.8.1 have a missing authorization vulnerability. This flaw allows lower-trust senders or agents with channel read access to bypass the configured read allowlist and access content or metadata from channels or rooms that should be restricted. The vulnerability affects message, reaction, pin, member, and related metadata read actions. The issue is resolved in version 2026.8.1.
CVSS v4.0
Score 7.1high
Affected software
openclaw
msteams
openclaw
feishu
openclaw
matrix
openclaw
googlechat
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) prior to 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets. This missing authorization allows a lower-trust sender or a steered agent with channel read permissions to retrieve content or metadata from channels or rooms excluded by the operator's read policy. The impact depends on the permissions of the connected bot account. The vulnerability is fixed in version 2026.8.1.
Potential Impact
An attacker or lower-trust user with channel read action access can bypass read restrictions and access unauthorized channel content or metadata. The severity is high with a CVSS 4.0 score of 7.1, indicating significant confidentiality impact without requiring user interaction or elevated privileges beyond low privileges.
Mitigation Recommendations
Upgrade OpenClaw channel plugins to version 2026.8.1 or later, where the missing authorization issue has been fixed. No additional mitigation is required once the update is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T01:03:42.740Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab72eeef7a7c54106c273c3
Added to database: 09/26/2026, 02:33:18 UTC
Last enriched: 09/26/2026, 02:47:42 UTC
Last updated: 09/26/2026, 03:38:07 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.