Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.22 and involves a policy confusion in room authorization. Instead of using stable room tokens to verify access, the system matches colliding room names. Attackers can exploit this by creating or using similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms. This means sensitive conversations or data shared within these rooms could be exposed to unauthorized individuals, potentially leading to information leakage or privacy breaches.

Useful 0 Not Useful 0