Skip to content

OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Moderate severity GitHub Reviewed Published Mar 26, 2026 in openclaw/openclaw • Updated Mar 29, 2026

Package

npm openclaw (npm)

Affected versions

<= 2026.3.24

Patched versions

2026.3.28

Description

Summary

Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit 11ea1f67863d88b6cbcb229dd368a45e07094bff requires stable group IDs for access decisions.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff.

Fix Commit(s)

  • 11ea1f67863d88b6cbcb229dd368a45e07094bff

References

@steipete steipete published to openclaw/openclaw Mar 26, 2026
Published to the GitHub Advisory Database Mar 29, 2026
Reviewed Mar 29, 2026
Last updated Mar 29, 2026

Severity

Moderate

EPSS score

Weaknesses

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Learn more on MITRE.

Reliance on Untrusted Inputs in a Security Decision

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. Learn more on MITRE.

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-52q4-3xjc-6778

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.