Openclaw cli: OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions (CVE-2026-32976)

In openclaw-cli versions <= 2026.3.10, channel-initiated configuration mutations were authorized based on the originating account's configWrites policy but did not consistently re-check the target account's scope. This allowed an authorized user on one account to mutate protected configuration of sibling accounts when those accounts had configWrites set to false. The vulnerability affects commands such as `/config set channels.<provider>.accounts.<id>...` and config-backed `/allowlist ... --config --account <id>`. The root cause was inconsistent authorization checks on resolved target scopes and ambiguous writes under channels and channels.<provider>.accounts. The fix in version 2026.3.11 enforces authorization against both origin and target scopes and restricts ambiguous writes to internal gateway clients with operator.admin privileges.

This vulnerability allows an authorized user on one account to bypass account-scoped configuration write restrictions and modify configuration settings of sibling accounts within the same gateway deployment. While it does not affect confidentiality or availability, it impacts integrity by enabling unauthorized configuration changes across accounts.

Upgrade openclaw-cli to version 2026.3.11 or later, which includes the official fix that enforces authorization checks on both origin and target account scopes and restricts ambiguous writes. No other workarounds are recommended.