Is there a patch available for EUVD-2026-45112?

Yes, a patch is available for EUVD-2026-45112. Update the affected software to the latest version immediately.

OpenClaw MS Teams EUVD-2026-45112

Q: What is the CVSS score of EUVD-2026-45112?

EUVD-2026-45112 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-62224 LOW

Authentication Bypass by Spoofing (CWE-290)

2026-07-17 VulnCheck

GHSA-fjfc-7x5g-g52w

Authentication Bypass Openclaw Msteams

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

AC:H reflects the AT:P attack requirement (allowFrom must be configured); PR:L for required authenticated lower-trust session; no availability or scope impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:03 vuln.today

DescriptionCVE.org

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.

AnalysisAI

Authorization bypass in OpenClaw MS Teams before 2026.5.12 allows authenticated lower-privileged users to escalate their effective permissions by spoofing display names that the allowFrom access-control feature trusts as immutable identifiers. The root flaw (CWE-290) is that the authorization decision is anchored to a mutable attribute - the display name - rather than a stable, non-spoofable identity token. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 2.3 reflects the limited blast radius and the attack requirement precondition.

Technical ContextAI

OpenClaw MS Teams (CPE: cpe:2.3:a:openclaw:msteams:*:*:*:*:*:*:*:*) is a third-party Microsoft Teams integration maintained by the OpenClaw project. The vulnerability lies in the allowFrom feature, which enforces access-control rules by checking the calling party's display name against an allow-list. Display names in Teams-based communication environments are user-controlled attributes and are not cryptographically bound to an identity - any authenticated party can change their display name to impersonate a higher-trust peer. CWE-290 (Authentication Bypass by Spoofing) classifies this root cause: the system confuses a presentational, mutable label with a trustworthy identity claim, enabling a spoof that satisfies the authorization check without the corresponding legitimate credential.

RemediationAI

Upgrade OpenClaw MS Teams to version 2026.5.12 or later, which is the vendor-released patch per the GitHub Security Advisory GHSA-7w4v-g4m6-j88v. Until the patch is applied, the most targeted compensating control is to disable or remove any allowFrom rules that rely solely on display names, effectively disabling the vulnerable feature. Alternatively, restrict access to the Teams integration to users whose display names cannot be modified by themselves or by peer users - in environments where Teams display names are centrally managed by Azure AD and user self-service name changes are disabled via tenant policy, the exploitability window narrows significantly. Note that disabling allowFrom rules entirely may break intended access-control workflows and should be evaluated against operational requirements before implementation.