CVE-2026-100583: Missing Authorization in openclaw discord
OpenClaw Discord versions before 2026.7.1 have an authorization bypass vulnerability that allows users with lower trust levels to access guild metadata that should be restricted by channel allowlists. This flaw enables attackers to circumvent Discord's read-target policies and retrieve information from servers or channels outside the permitted allowlist.
AI Analysis
Technical Summary
CVE-2026-100583 is an authorization bypass vulnerability in OpenClaw Discord affecting versions prior to 2026.7.1. The vulnerability occurs in guild metadata read actions, permitting lower-trust senders to access guild metadata excluded by channel allowlists. This bypasses the configured Discord read-target policy, allowing unauthorized access to guild metadata from servers or channels outside the operator's allowlist.
Potential Impact
Attackers with lower trust levels can retrieve guild metadata that should be restricted, potentially exposing sensitive information about servers or channels that are intended to be inaccessible. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity impact with network attack vector, low complexity, and no user interaction required.
Mitigation Recommendations
Upgrade OpenClaw Discord to version 2026.7.1 or later to remediate this authorization bypass vulnerability. No other mitigation steps are indicated. Patch status is confirmed by the affectedVersions field indicating the fix in 2026.7.1.
CVE-2026-100583: Missing Authorization in openclaw discord
Description
OpenClaw Discord versions before 2026.7.1 have an authorization bypass vulnerability that allows users with lower trust levels to access guild metadata that should be restricted by channel allowlists. This flaw enables attackers to circumvent Discord's read-target policies and retrieve information from servers or channels outside the permitted allowlist.
CVSS v4.0
Score 5.3medium
Affected software
openclaw
discord
pkg:github/openclaw/discordRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-100583 is an authorization bypass vulnerability in OpenClaw Discord affecting versions prior to 2026.7.1. The vulnerability occurs in guild metadata read actions, permitting lower-trust senders to access guild metadata excluded by channel allowlists. This bypasses the configured Discord read-target policy, allowing unauthorized access to guild metadata from servers or channels outside the operator's allowlist.
Potential Impact
Attackers with lower trust levels can retrieve guild metadata that should be restricted, potentially exposing sensitive information about servers or channels that are intended to be inaccessible. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity impact with network attack vector, low complexity, and no user interaction required.
Mitigation Recommendations
Upgrade OpenClaw Discord to version 2026.7.1 or later to remediate this authorization bypass vulnerability. No other mitigation steps are indicated. Patch status is confirmed by the affectedVersions field indicating the fix in 2026.7.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T01:03:42.740Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab72ef0f7a7c54106c273c8
Added to database: 09/26/2026, 02:33:20 UTC
Last enriched: 09/26/2026, 02:48:06 UTC
Last updated: 09/26/2026, 03:17:51 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.