https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 07:47:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-100556 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw (npm package openclaw) versions &gt;= 2026.5.2 and &lt; 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorization can issue the /new &lt;model&gt; command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session, potentially changing provider routing, cost, data flow, or availability. It does not allow adding a new provider or host command execution. The issue is fixed in version 2026.8.1.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw (npm package openclaw) versions &gt;= 2026.5.2 and &lt; 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorization can issue the /new &lt;model&gt; command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session, potentially changing provider routing, cost, data flow, or availability. It does not allow adding a new provider or host command execution. The issue is fixed in version 2026.8.1.</p> https://vulnerability.circl.lu/vuln/cve-2026-100556