OpenClaw EUVD-2026-87500

Requires the OpenClaw Microsoft Teams integration to be deployed with groupPolicy set to 'allowlist' AND the configured access group to be missing or of an unsupported type - this misconfiguration is what causes the denied group-resolution result to be silently accepted at final message admission. The attacker must be an authenticated participant able to message the OpenClaw bot in Teams (PR:L), but need not be on the allowlist; no victim user interaction is required (UI:N). Limiting factors: the flaw does nothing under a correctly-resolvable allowlist group, and realized impact is bounded by whatever conversations, tools, and data the triggered agent is permitted to reach, so a minimally-privileged agent yields little.

Signals are consistent and point to a genuine-but-modest issue, not an emergency. The vendor CVSS 4.0 base is 5.3 (AV:N/AC:L/PR:L/UI:N with VC:L/VI:L/VA:N), which correctly frames this as a network-reachable, low-complexity authorization-boundary bypass with only limited confidentiality/integrity impact and no availability impact - my independent CVSS 3.1 mapping (~5.4, C:L/I:L/A:N) agrees. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The PR:L is appropriate because the attacker must already be an authenticated participant in the target Microsoft Teams tenant/conversation - they are simply not on the OpenClaw admin's allowlist. The realistic ceiling is entirely data-dependent: the CVSS caps impact at Low, but the description explicitly says impact 'depends on the conversations, tools, and data available to that agent,' meaning a heavily-privileged agent could make consequences worse than the base score implies. No signals conflict; the main gap is that no exploitation-probability (EPSS) or SSVC data was supplied, so prioritization rests on the CVSS vector and the misconfiguration-gated nature of the bug.

An OpenClaw operator connects the bot to Microsoft Teams and sets groupPolicy to allowlist, intending only specific groups to invoke the agent, but the configured access group is missing or of an unsupported type. Because the resulting denied group-resolution result is not rejected by the final message-admission check, any Teams member outside the allowlist can message the bot and trigger the configured agent, reaching whatever conversations, tools, and data that agent exposes. No public exploit code is identified; exploitation requires only an ordinary authenticated Teams participant and no user interaction from the victim.