OpenClaw versions prior to 2026.4.12 contain a vulnerability where empty approver lists could be interpreted as explicit approval authorization. This flaw allows an attacker outside the normal channel authorization to resolve pending approvals if they know an approval ID. The issue is fixed in version 2026.4.12 and later.