CVE-2026-100550

Katalog CVE

CVSS 5.4 · Medium EPSS 0,19%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 5.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admission check, so a Teams member who is not on the allowlist can still trigger the configured agent despite the administrator's group boundary. The impact depends on the conversations, tools, and data available to that agent. The issue is fixed in version 2026.8.1.

Rincian

Terbit di NVD

26 September 2026

Terakhir diubah

28 September 2026

Status NVD

Deferred

CVSS 3.1

5.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8938-r7c6-54vq
• https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-access-group