CVE-2026-35624
Policy Confusion in OpenClaw Allows Unauthorized Nextcloud Talk Access
Publication date: 2026-04-09
Last updated on: 2026-04-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.22 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-807 | The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenClaw versions before 2026.3.22 and involves a policy confusion in room authorization. Instead of using stable room tokens to verify access, the system matches colliding room names. Attackers can exploit this by creating or using similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.
How can this vulnerability impact me? :
The vulnerability allows attackers to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms. This means sensitive conversations or data shared within these rooms could be exposed to unauthorized individuals, potentially leading to information leakage or privacy breaches.