VulnerabilityAwaiting Analysis

CVE-2026-62224

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names.

LOW 2.3EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-290, CWE-863
Source: disclosure@vulncheck.com

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-7w4v-g4m6-j88v
https://www.vulncheck.com/advisories/openclaw-ms-teams-authorization-bypass

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.