Openclaw cli: OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send (CVE-2026-35621)

The vulnerability arises from a missing sink-side internal admin privilege check in the /allowlist command handler of openclaw-cli. While the gateway client with operator.write scope can legitimately call chat.send, which internally authorizes commands generically, this allows indirect mutation of channel allowFrom and groupAllowFrom policies that should be restricted to operator.admin. The /allowlist command persists these changes via writeConfigFile without verifying admin scope, creating a control-plane privilege mismatch. The flaw is fixed by adding an explicit operator.admin check before config writes in /allowlist, aligning it with protections in /config and /plugins commands.

An authenticated gateway client limited to operator.write scope can persistently widen direct message or group allowlists for channels, effectively escalating privileges to modify channel authorization policies. This undermines the intended privilege separation between write-scoped actions and admin-only configuration mutations, potentially weakening channel access controls.

A fix is available in openclaw-cli version 2026.3.24. Users should upgrade to this version or later to ensure the missing admin privilege check in /allowlist is enforced. The remediation involves adding an operator.admin scope check before any persistent config writes in /allowlist, consistent with existing protections in other config mutation commands. Secondary policy checks like configWrites and pairing-store controls remain but do not replace the required privilege enforcement.