Threats tagged 'ghsa-jwrq-8g5x-5fhm'

A vulnerability in the openclaw npm package prior to version 2026.4.14 allows collect-mode queue batches to reuse the last sender's authorization context. This flaw could cause messages from different senders to be processed with the authorization context of the final sender in the batch, potentially granting earlier messages elevated privileges. The issue is fixed in version 2026.4.14 by splitting batches according to sender authorization context before dispatch.