What is the CVSS score of CVE-2026-32904?

CVE-2026-32904 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N.

Which versions of Openclaw are affected by CVE-2026-32904?

Organizations using OpenClaw before 2026.2.26 should be aware of moderate risk from CVE-2026-32904, a incorrect authorization vulnerability rated CVSS 4.6.. A patch is available.

How to fix or mitigate CVE-2026-32904?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Openclaw CVE-2026-32904

EUVD-2026-14586 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-23 VulnCheck

GHSA-vm28-vgjp-xc99

Authentication Bypass Openclaw

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14586

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

Patch released

Mar 23, 2026 - 22:00 nvd

Patch available

CVE Published

Mar 23, 2026 - 21:36 nvd

MEDIUM 4.6

DescriptionCVE.org

OpenClaw before 2026.2.26 contains an authorization bypass vulnerability in group allowlist policy evaluation that accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.

AnalysisAI

OpenClaw before version 2026.2.26 contains an authorization bypass vulnerability in group allowlist policy evaluation that improperly accepts sender identities from DM pairing-store approvals. Attackers with low privileges can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized access to restricted groups. The vulnerability carries a moderate CVSS score of 4.6 with user interaction required, and patches are available from the vendor.

Technical ContextAI

OpenClaw's group access control mechanism relies on an allowlist policy to enforce authorization decisions. The vulnerability stems from CWE-863 (Incorrect Authorization), specifically where the application incorrectly trusts sender identities sourced from the Direct Message (DM) pairing-store approval mechanism when evaluating group membership allowlist policies. The DM pairing-store was designed for peer-to-peer identity verification in messaging contexts but is being inappropriately reused for group authorization decisions. This represents a critical confusion of authorization boundaries where identities verified for one security domain (DM pairing) are accepted without re-validation in a different security domain (group access control). Affected product: OpenClaw (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) versions prior to 2026.2.26.

RemediationAI

Upgrade OpenClaw to version 2026.2.26 or later to apply the security fix. The vendor has released patches addressing the authorization bypass; refer to the GitHub commit references 8bdda7a651c21e98faccdbbd73081e79cffe8be0 and 64de4b6d6ae81e269ceb4ca16f53cda99ced967a for implementation details. Organizations unable to immediately patch should implement compensating controls by restricting DM pairing approvals to trusted identities only, enforcing additional audit logging on group access requests, and implementing network-level access controls to limit exposure of group management endpoints. Consult the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-wm8r-w8pf-2v6w for complete remediation guidance specific to your deployment.