OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling. This flaw allows lower-trust callers to perform actions that normally require stronger authorization checks. Exploitation is possible when the affected feature is enabled and reachable, and attackers can leverage misconfigured input paths to skip requester authorization and execute privileged operations.