Which versions of OpenClaw Feishu are affected by CVE-2026-62188?

OpenClaw's Feishu integration (versions 2026.6.6 and earlier) contains a privilege escalation vulnerability allowing authenticated users to bypass authorization controls and access restricted Feishu…. A patch is available.

How to fix or mitigate CVE-2026-62188?

Within 24 hours, inventory all users with access to the OpenClaw Feishu integration, document their privilege levels, and audit access logs for the past 30 days. Within 7 days, restrict Feishu integration access to only essential business roles, disable non-critical Feishu permission tools at the integration level where operationally feasible, and conduct detailed review of recent activity for signs of privilege escalation. Within 30 days, implement additional application-level authorization validation, deploy monitoring and alerting for unusual permission elevation attempts, establish continuous audit logging of all Feishu integration activity, and maintain surveillance of vendor advisories for patch availability on CVE-2026-62188.

OpenClaw Feishu CVE-2026-62188

Q: What is the CVSS score of CVE-2026-62188?

CVE-2026-62188 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Incorrect Authorization (CWE-863)

2026-07-13 VulnCheck

Authentication Bypass Openclaw Feishu

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable tool needing an existing low-trust authenticated caller (PR:L) and no interaction; broken authorization exposes and alters protected data (C:H/I:H) without availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:03 vuln.today

CVE Published

Jul 13, 2026 - 21:30 cve.org

HIGH 8.6

DescriptionCVE.org

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in version 2026.6.9.

AnalysisAI

Privilege escalation via broken authorization in the OpenClaw @openclaw/feishu integration (versions 2026.6.6 and earlier) allows a lower-trust, already-authenticated caller to invoke Feishu permission tools that should have been blocked by per-account disablement settings. Because the enforcement gap lets a low-privilege actor perform actions requiring stronger authorization, the flaw carries high confidentiality and integrity impact (CVSS 4.0 base 8.6). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

@openclaw/feishu is a Node.js/npm integration package (CPE cpe:2.3:a:openclaw:feishu) that exposes 'permission tools' bridging OpenClaw automation to Feishu/Lark, the enterprise collaboration and messaging suite. The root cause is CWE-863 (Incorrect Authorization): the code performs an authorization check but reaches the wrong decision, specifically failing to honor per-account disablement settings that are meant to gate which callers or input paths may invoke privileged Feishu actions. Rather than a missing check, this is a check that is present but evaluated incorrectly, so a request that should be denied under account-level policy is instead permitted when the affected feature is enabled and reachable.

RemediationAI

Vendor-released patch: upgrade @openclaw/feishu to 2026.6.9 or later, which corrects the per-account authorization enforcement; consult the GitHub advisory GHSA-w8wf-3qvj-6xqf (https://github.com/openclaw/openclaw/security/advisories/GHSA-w8wf-3qvj-6xqf) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-feishu-authorization-bypass) for exact release notes. If immediate upgrade is not possible, reduce exposure by disabling the affected Feishu permission tools/feature where it is not required (removing the reachable code path, at the cost of losing that automation), and by restricting which accounts and input paths can reach the integration - tighten account-level trust so no low-privilege callers can invoke the permission tools, and monitor the advisory-referenced actions for anomalous authorization use until the patched version is deployed.