What is the CVSS score of CVE-2026-32911?

CVE-2026-32911 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L.

Which versions of Synology are affected by CVE-2026-32911?

CVE-2026-32911 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 6.4. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-32911?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Synology CVE-2026-32911

EUVD-2026-14595 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-23 VulnCheck

GHSA-gpwv-vx7w-xqm4

Authentication Bypass Synology

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14595

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

Patch released

Mar 23, 2026 - 22:00 nvd

Patch available

CVE Published

Mar 23, 2026 - 21:36 nvd

MEDIUM 6.4

DescriptionCVE.org

OpenClaw versions 2026.2.22 prior to 2026.2.24 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks to dispatch unauthorized messages to downstream agents and tools.

AnalysisAI

Synology OpenClaw versions prior to 2026.2.24 contain an authorization bypass in the synology-chat channel plugin where misconfigured allowlist policies with empty user IDs fail to enforce access controls. Authenticated attackers with Synology sender privileges can exploit this flaw to send unauthorized messages through downstream agents and tools. A patch is available.

Technical ContextAI

The vulnerability exists in OpenClaw's synology-chat channel plugin, which integrates with Synology Chat for message routing and agent communication. The affected component implements a dmPolicy (dispatch management policy) authorization mechanism that relies on an allowlist validation pattern. When the allowlist mode is enabled but the allowedUserIds field is left empty, the validation logic fails open—a classic CWE-863 (Incorrect Authorization) flaw—rather than failing secure by denying all access. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* indicates this affects the core OpenClaw application across all configurations. The root cause is improper input validation on the allowedUserIds configuration parameter; empty or missing allowlists should trigger an explicit deny policy rather than permit access to all authenticated senders.

RemediationAI

Upgrade OpenClaw to version 2026.2.24 or later, which includes fixes committed in the repository (references: https://github.com/openclaw/openclaw/commit/0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5 and https://github.com/openclaw/openclaw/commit/7655c0cb3a47d0647cbbf5284e177f90b4b82ddb). Prior to patching, organizations should immediately audit synology-chat channel plugin configurations and ensure that any dmPolicy set to allowlist mode has non-empty, explicitly defined allowedUserIds values; disable the plugin or implement upstream network access controls if allowlist cannot be properly configured. Monitor Synology Chat integration logs for unauthorized message dispatch attempts and review downstream agent execution logs for anomalous activity.