Incorrect Authorization in OpenClaw Feishu Extension

Executive Summary

CVE-2026-62188 is an incorrect authorization vulnerability in OpenClaw's Feishu permission tools. The flaw exists in versions 2026.6.6 and earlier, where the system could ignore per-account disablement settings. This means that when the affected feature is enabled and accessible, lower-trust callers or configured input paths can perform actions that should require stronger authorization or policy checks.

The vulnerability is classified under CWE-863 (Incorrect Authorization) and has been assigned a high severity score. It is fixed in version 2026.6.9 of OpenClaw.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your system is running an affected version of OpenClaw Feishu (versions 2026.6.6 or earlier) and verifying whether the vulnerable Feishu permission tools feature is enabled and accessible.

• Check the installed version of OpenClaw Feishu. If the version is 2026.6.6 or earlier, the system is vulnerable.
• Review the configuration of the Feishu permission tools to determine if the affected feature is enabled. This may involve inspecting configuration files or administrative settings.
• Monitor network traffic or logs for unexpected access to the Feishu permission tools, particularly from lower-trust callers or input paths. This could indicate exploitation attempts.

Specific commands or tools for detection are not provided in the available resources. However, you may use standard system auditing tools to verify the installed version and configuration. For example:

• On a system with OpenClaw installed, run a version check command if available (e.g., `openclaw --version` or inspect package manager logs).
• Review configuration files (e.g., `config.yml` or similar) for settings related to Feishu permission tools to confirm if the feature is enabled.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of OpenClaw (2026.6.6 or earlier) with the Feishu permission tools enabled, this vulnerability could allow unauthorized actions to be performed by lower-trust users or inputs. Specifically:

• Lower-trust callers or configured input paths could bypass intended authorization checks, potentially gaining access to sensitive operations or data.
• The impact depends on your configuration and whether untrusted inputs can reach the affected feature. If exploited, it could lead to unauthorized modifications or access to confidential information.

The vulnerability does not alter OpenClaw's trusted-operator model but could undermine security controls if the affected feature is exposed to untrusted users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with standards and regulations in the following ways:

• GDPR: If the vulnerability leads to unauthorized access or disclosure of personal data, it could violate GDPR's requirements for data protection and confidentiality. Organizations may face penalties for failing to implement appropriate technical and organizational measures to secure personal data.
• HIPAA: For organizations handling protected health information (PHI), this vulnerability could result in unauthorized access to PHI, violating HIPAA's Security Rule. This could lead to non-compliance and potential fines if the vulnerability is exploited.

The high confidentiality and integrity impact (as indicated by the CVSS scores) suggests that this vulnerability could undermine compliance efforts if not addressed promptly. Organizations should assess their exposure and apply the patch or mitigations to avoid potential compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

The following steps are recommended to mitigate this vulnerability:

• Upgrade to OpenClaw Feishu version 2026.6.9 or later, as the issue is patched in this release.
• If upgrading is not immediately possible, restrict the affected Feishu permission tools feature to trusted operators only.
• Disable the Feishu permission tools feature entirely if it is not required for your operations.
• Apply general hardening measures, such as keeping channel and tool allowlists narrow to limit exposure.
• Avoid sharing Gateways between untrusted users to reduce the risk of unauthorized access.
• Monitor systems for unusual activity, particularly actions that bypass expected authorization checks.

Useful 0 Not Useful 0