Is there a patch available for EUVD-2026-45094?

Yes, a patch is available for EUVD-2026-45094. Update the affected software to the latest version immediately.

OpenClaw EUVD-2026-45094

Q: What is the CVSS score of EUVD-2026-45094?

EUVD-2026-45094 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-62206 MEDIUM

Missing Authorization (CWE-862)

2026-07-17 VulnCheck

GHSA-gghq-rr94-q6mj

Authentication Bypass Openclaw

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable, low-complexity exploit by authenticated low-privilege caller; integrity impact is high due to unauthorized moderation writes, availability impact is low.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:08 vuln.today

DescriptionCVE.org

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

AnalysisAI

Missing authorization in OpenClaw's Discord moderation action handling allows a low-privilege caller to perform moderation operations - such as banning, kicking, or muting users - that should require elevated permissions. All OpenClaw versions prior to 2026.6.9 are affected per the vendor's GitHub security advisory (GHSA-f6p7-6326-vf7v), reported by VulnCheck. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the CVSS 4.0 integrity impact is rated High, reflecting meaningful abuse potential where a lower-trust actor gains outsized moderation authority over a Discord community.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is a Discord-integrated moderation platform. The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaw where the application fails to verify that the authenticated caller holds a sufficient permission level before executing a privileged operation. In this case, the affected code path processes Discord moderation commands - actions that alter server membership or user state - without enforcing the required policy or role check. The CVSS 4.0 vector includes AT:P (Attack Requirements: Present), which aligns with the description's caveat that exploitation depends on operator configuration and whether a lower-trust input source can reach the vulnerable path. The vulnerability has no confidentiality impact (VC:N/SC:N) but yields High integrity impact (VI:H) on the vulnerable system, consistent with unauthorized write-class actions against Discord's moderation state.

RemediationAI

The primary fix is to upgrade OpenClaw to version 2026.6.9 or later, which addresses the missing authorization check per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-f6p7-6326-vf7v. Until patching is possible, operators should audit their input routing configuration to ensure lower-trust callers cannot reach the Discord moderation action paths; restricting access to the vulnerable endpoint to only highly-trusted callers or internal service identities eliminates the attack surface without requiring an immediate upgrade. Operators should also review OpenClaw's role and permission configuration to enforce least-privilege access, ensuring no caller holds more moderation capability than required. The VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-moderation-actions provides additional context for prioritization.