OpenClaw EUVD-2026-87497

Requires all of: (1) OpenClaw version >=2026.6.9 and <2026.8.1; (2) the Feishu channel plugin in use with a configured account that belongs to more than one group; (3) the tools.message.crossContext.allowWithinProvider setting explicitly DISABLED - the bypass only matters when the operator intended to block within-provider cross-context mutation; (4) an authenticated/admitted sender (PR:L); and (5) the target Feishu group must be one both the sender and the configured account are otherwise permitted to access, since Feishu membership and group authorization checks still apply. Limiting factors: impact is confined to pin removal (message mutation), no confidentiality or availability loss, and the flaw is inert under the default posture where the cross-context guard is enabled.

This is a genuinely low-priority issue despite the 'Authentication Bypass' tag. The vendor CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) already reflects a narrow, integrity-only flaw: the only demonstrated impact is removing a pin (message mutation) from a Feishu group, with no confidentiality or availability impact. Exploitation is authenticated (PR:L) - the actor must already be an admitted sender, and Feishu membership plus group authorization still apply, so the attacker can only affect groups both they and the configured account can already reach. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is neither actively exploited nor trivially weaponizable. It also only manifests in a non-default posture: the cross-context guard (tools.message.crossContext.allowWithinProvider) must be explicitly disabled for the bypass to have any effect. Net assessment: real but minor authorization-policy gap, not an operational priority. Note the CWE-863 (improper authorization) classification conflicts with the 'Authentication Bypass' tag - this is an authorization/policy-scope bypass, not authentication bypass.

An organization runs OpenClaw with a Feishu account joined to multiple groups and disables cross-context mutation (allowWithinProvider=false) to keep actions scoped to the originating group. An authenticated sender in one group steers the agent to issue a Feishu unpin whose native chatId targets a different group both parties can access; because unpin never declared chatId as a delivery target, the shared cross-context check is skipped and the pin is removed in the other group. No public exploit code is available, and impact is limited to unpinning messages.