Threats tagged 'ghsa-4793-q4pp-q755'

OpenClaw's Matrix integration (npm package @openclaw/matrix) versions 2026.2.2 up to but not including 2026.8.1 improperly handle case sensitivity when deriving authorization identities. This causes distinct authenticated Matrix accounts that differ only by case or Unicode folding to be treated as the same authorization identity. Consequently, an attacker controlling a colliding account identifier can inherit privileges such as allowlist, owner-command, exec-approval, or plugin-approval authority assigned to another account. The vulnerability is fixed in version 2026.8.1.