Description
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openclaw | msteams | < 2026.5.12 | 2026.5.12 |
Advisories 1
- WID-SEC-2026-2133 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2026
References
- GitHub Security Advisory (GHSA-7w4v-g4m6-j88v) vendor-advisory
- VulnCheck Advisory: OpenClaw MS Teams < 2026.5.12 Authorization Bypass third-party-advisory