Openclaw cli: OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries

The openclaw CLI package for LINE has a group-authorization scope mismatch vulnerability where DM pairing-store entries, which are intended for direct message approvals, also satisfy group allowlist checks. This occurs because the group allowlist composition inherits pairing-store entries, causing DM-paired senders to be authorized as group senders under allowlist mode. The root cause is the unintended sharing of pairing-store entries between DM and group allowlists. The fix isolates group allowlist composition from pairing-store entries and centralizes allowlist management to preserve intended DM-only pairing behavior. The vulnerability is patched in version 2026.2.26.

This vulnerability allows sender IDs approved for direct messaging to bypass intended group allowlist restrictions, potentially granting unauthorized group sender access. The impact is an authorization scope mismatch that could lead to unintended group message sending permissions. There is no indication of active exploitation in the wild.

A patch is available in openclaw CLI version 2026.2.26 and later. Users should upgrade to version 2026.2.26 or newer to resolve this authorization scope mismatch. No additional mitigation actions are specified or required beyond applying the official fix.