OpenClaw versions up to 2026.4.1 have a vulnerability where the /allowlist endpoint does not enforce owner-only restrictions for cross-channel allowlist writes. This allows an authorized non-owner sender to attempt modifications to the allowlist of a different channel. The issue is fixed in version 2026.4.8.