Which versions of OpenClaw Feishu are affected by CVE-2026-62187?

An authorization bypass in @openclaw/feishu npm package (versions ≤2026.6.6) allows authenticated users to bypass account-level access controls on Feishu/Lark operations.. A patch is available.

How to fix or mitigate CVE-2026-62187?

Within 24 hours: identify all instances of @openclaw/feishu in your codebase and review current deployed versions. Within 7 days: test version 2026.6.9 upgrade in development environments to verify authorization controls and Feishu integrations function correctly; prioritize systems that accept external user input. Within 30 days: deploy version 2026.6.9 to production systems, verify all functional tests pass, and confirm per-account access restrictions are properly enforced.

OpenClaw Feishu CVE-2026-62187

Q: What is the CVSS score of CVE-2026-62187?

CVE-2026-62187 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Incorrect Authorization (CWE-863)

2026-07-13 VulnCheck

Authentication Bypass Node.js Openclaw Feishu

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable low-complexity authorization bypass by an already-privileged low-trust caller (PR:L), yielding high confidentiality and integrity impact but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:02 vuln.today

CVE Published

Jul 13, 2026 - 21:30 cve.org

HIGH 8.6

DescriptionCVE.org

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue is fixed in version 2026.6.9. Impact depends on the operator's configuration and whether lower-trust input can reach the affected feature.

Articles & Coverage 1

News 3 New Node.js Vulnerabilities - 3 High Severity Jul 14, 2026

AnalysisAI

Authorization bypass in the @openclaw/feishu npm package (versions <= 2026.6.6) allows a lower-trust caller - or attacker-influenced input reaching a configured input path - to perform Feishu (Lark) actions that should have required stronger authorization, because per-account disablement can be ignored. Authenticated remote attackers can trigger unauthorized operations affecting confidentiality and integrity; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2026.6.9. Real-world impact is gated by the operator's configuration and whether untrusted input can reach the affected feature.

Technical ContextAI

OpenClaw is a Node.js tooling ecosystem, and @openclaw/feishu provides tool integrations for Feishu/Lark (the collaboration and messaging platform). The root cause is CWE-863 (Incorrect Authorization): the package enforces authorization inconsistently, so a per-account disablement control intended to block a given account from a feature is not honored on all code paths. As identified by the CPE cpe:2.3:a:openclaw:feishu, the affected component is the Feishu tools package specifically. Because the tools sit between callers/input paths and Feishu APIs, a caller with lower trust - or a data path that carries lower-trust input - can reach an action whose policy check is skipped, effectively bypassing an authorization boundary the operator believed was in place.

RemediationAI

Upgrade the @openclaw/feishu npm dependency to version 2026.6.9 or later, which contains the fix (Vendor-released patch: 2026.6.9); pin the version in package.json and rebuild/redeploy so transitive installs cannot pull a vulnerable release. Until the upgrade is deployed, reduce exposure by ensuring lower-trust callers and untrusted input paths cannot reach the Feishu tools feature - for example, restrict which accounts or callers can invoke the tools, and audit any configured input path that could carry attacker-influenced data into the affected feature, accepting that this may disable legitimate automation that relies on those paths. Because the per-account disablement control cannot be trusted to hold on the vulnerable versions, do not rely on it as a compensating control. Consult the OpenClaw advisory GHSA-2q7j-2vhx-56g8 (https://github.com/openclaw/openclaw/security/advisories/GHSA-2q7j-2vhx-56g8) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-feishu-tools-authorization-bypass) for specifics.