The OpenClaw npm package before version 2026.7.1 has a security flaw where it improperly trusts the provenance of the requester in the message.action field. In deployments that honor caller identity and enforce operator scopes, a write-scoped caller can supply another user's identifier to channel authorization checks, effectively spoofing that identity. This enables the caller to perform channel actions that would otherwise be denied to them. The vulnerability is addressed in version 2026.7.1. As a workaround, restricting message.action usage to administrators and disabling sensitive channel actions that rely on requester identity can mitigate the risk.

An attacker with write-scoped permissions can impersonate other users by spoofing their identity in channel authorization checks, potentially performing unauthorized actions that the real caller would be denied. The severity is high due to the potential for privilege escalation within the affected system. The impact varies based on the specific channel enabled, the action invoked, and the permissions of the targeted account. Trusted authentication methods using shared-secret tokens or passwords are not affected.

A fix is available in OpenClaw version 2026.7.1 and should be applied to remediate this vulnerability. Until the update can be applied, it is recommended to restrict the use of message.action to administrators only and disable any sensitive channel actions that depend on requester identity to reduce the risk of exploitation.