Threats tagged 'ghsa-79rr-5c85-xvw3'

OpenClaw versions prior to 2026.4.15 have an authorization bypass vulnerability in the Matrix room control-command authorization mechanism. The flaw arises because the system trusts direct message (DM) pairing-store entries, allowing attackers with DM-paired sender IDs to execute privileged room control commands without being on configured allowlists. This can lead to unauthorized privileged actions within OpenClaw bot rooms.