Threats tagged 'ghsa-gq8x-6m4q-4rg7'

OpenClaw versions prior to 2026.4.10 have an insufficient access control vulnerability in the Nostr plugin HTTP profile routes. This flaw allows users with operator write permissions to persist profile configuration changes without requiring admin privileges. Exploitation involves modifying Nostr profile settings via unprotected mutation endpoints, leading to unauthorized configuration persistence.