CVE-2026-27484 LOW

CVE-2026-27484: OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows

Vendor Openclaw
Product openclaw
Weakness CWE-862 · Missing authorization
Published February 21, 2026
Last update February 24, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.

Key dates

02Disclosure timeline

February 21, 2026 CVE published
February 24, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-36680 WordPress Image Regenerate & Select Crop plugin <= 7.1.0 - Broken Access Control vulnerability CVE-2025-26733 WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerability CVE-2025-31528 WordPress StaticPress plugin <= 0.4.5 - Broken Access Control vulnerability CVE-2024-2544 Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions CVE-2025-62884 WordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerability