The OpenClaw Feishu npm package versions before 2026.6.9 contain an authorization bypass vulnerability where per-account disablement can be ignored. This allows a lower-privileged caller or a configured input path to perform actions without the required stronger authorization or policy enforcement. The vulnerability is addressed by an update in version 2026.6.9. The severity is high with a CVSS 4.0 score of 8.6, indicating network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Exploitation of this vulnerability could lead to unauthorized operations being performed by actors with lower trust levels than intended by the system's authorization policies. The actual impact depends on how the operator configures the system and whether untrusted inputs can reach the vulnerable functionality. There is no indication of known exploits in the wild at this time.

Upgrade the OpenClaw Feishu package to version 2026.6.9 or later, where this authorization issue is fixed. Since this is a client-side npm package, applying the official update is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No additional vendor advisory content is available to indicate alternative mitigations.