GHSA-j48q-3j3c-39fr
OpenClaw versions 2026.6.6 before 2026.6.9 have an authorization bypass vulnerability affecting Discord guild actions. This flaw allows lower-trust callers to perform actions that normally require stronger authorization. The vulnerability arises from misconfigured input paths that enable skipping cross-provider requester authorization, leading to execution of restricted operations.
AI Analysis
Technical Summary
CVE-2026-62192 is an authorization bypass vulnerability in OpenClaw affecting Discord guild actions. Versions prior to 2026.6.9 allow attackers with lower trust levels to bypass authorization checks due to misconfigured input paths. This bypass permits execution of operations that should require higher authorization, violating intended access controls. The vulnerability is categorized under CWE-863 (Incorrect Authorization). No known exploits are reported in the wild. No patch or official fix information is currently available.
Potential Impact
Attackers exploiting this vulnerability can perform restricted Discord guild actions without proper authorization, potentially leading to unauthorized changes or access within the affected system. The impact is considered high due to the ability to bypass authorization controls, but no known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten authorization configurations for Discord guild actions in OpenClaw to prevent misuse of lower-trust caller privileges.
GHSA-j48q-3j3c-39fr
Description
OpenClaw versions 2026.6.6 before 2026.6.9 have an authorization bypass vulnerability affecting Discord guild actions. This flaw allows lower-trust callers to perform actions that normally require stronger authorization. The vulnerability arises from misconfigured input paths that enable skipping cross-provider requester authorization, leading to execution of restricted operations.
CVSS v4.0
Affected software
pkg:github/openclaw/openclawRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-62192 is an authorization bypass vulnerability in OpenClaw affecting Discord guild actions. Versions prior to 2026.6.9 allow attackers with lower trust levels to bypass authorization checks due to misconfigured input paths. This bypass permits execution of operations that should require higher authorization, violating intended access controls. The vulnerability is categorized under CWE-863 (Incorrect Authorization). No known exploits are reported in the wild. No patch or official fix information is currently available.
Potential Impact
Attackers exploiting this vulnerability can perform restricted Discord guild actions without proper authorization, potentially leading to unauthorized changes or access within the affected system. The impact is considered high due to the ability to bypass authorization controls, but no known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten authorization configurations for Discord guild actions in OpenClaw to prevent misuse of lower-trust caller privileges.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j48q-3j3c-39fr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-62192"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a55ff8368715ace432f4217
Added to database: 07/14/2026, 09:21:07 UTC
Last enriched: 07/14/2026, 09:42:57 UTC
Last updated: 07/18/2026, 12:45:58 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.