Description
OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy settings, and the /allowlist mutating commands fail to enforce operator.admin scope. Attackers with operator.write scope can invoke /send on|off|inherit to persistently mutate the current session's sendPolicy, and execute /allowlist add commands to modify config-backed allowFrom entries and pairing-store allowlist entries without proper admin authorization.
INFO
Published Date :
2026-04-10T16:03:09.127Z
Last Modified :
2026-04-10T16:03:09.127Z
Source :
VulnCheck
AFFECTED PRODUCTS
The following products are affected by CVE-2026-35620 vulnerability.
| Vendors | Products |
|---|---|
| Openclaw |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-35620.
