{"id":"EUVD-2026-33335","enisaUuid":"7a8f1843-54b6-3d22-bda8-30354b0473a6","description":"OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.","datePublished":"May 29, 2026, 3:10:31 PM","dateUpdated":"Sep 24, 2026, 2:17:32 PM","baseScore":7.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j\nhttps://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons\n","aliases":"CVE-2026-35630\nGHSA-hx4v-668p-g2qr\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"48bdbfb6-d21b-32bc-ae3a-494cbaf9b0d7","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.5.18"}],"enisaIdVendor":[{"id":"2c38f1c7-7216-3881-a9d6-98d27a2b117d","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"1b77d62d-07c7-385e-b0b6-61d40cdb6275","vulnerability":{"id":"CVE-2026-35630","description":"OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.","datePublished":"May 29, 2026, 3:10:31 PM","dateUpdated":"Sep 24, 2026, 2:17:32 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j\nhttps://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons\n","enisa_id":"EUVD-2026-33335\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Oct 27, 2026, 7:18:59 AM","vulnerabilityProduct":[{"id":"74b8f3c7-77de-3ccc-b7bd-da2c6b449362","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.5.18"}],"vulnerabilityVendor":[{"id":"df45c2dd-ab43-31e9-a284-9cca3ac95378","vendor":{"name":"OpenClaw"}}]}},{"id":"fd2c144d-a8e0-3442-a2bb-958c8cb8e258","vulnerability":{"id":"GHSA-hx4v-668p-g2qr","description":"Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity","datePublished":"May 29, 2026, 6:31:33 PM","dateUpdated":"Jul 2, 2026, 8:50:05 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35630\nhttps://www.vulncheck.com/advisories/openclaw-qqbot-missing-approver-identity-enforcement-in-native-approval-buttons\n","enisa_id":"EUVD-2026-33335\n","aliases":"GHSA-hx4v-668p-g2qr\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"5a424791-b4b8-3115-9884-88cc6c913f7a","advisory":{"id":"WID-SEC-W-2026-1738","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsmechanismen zu umgehen, erhöhte Berechtigungen zu erlangen, Informationen offenzulegen, Konfigurationen zu manipulieren, beliebige Befehle oder Code auszuführen sowie interne Systeme über SSRF anzugreifen.","datePublished":"May 28, 2026, 10:00:00 PM","dateUpdated":"May 31, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1738.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1738\n","aliases":"CVE-2026-32906\nCVE-2026-34507\nCVE-2026-35630\nCVE-2026-35673\nCVE-2026-35674\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"445b3783-839b-3dbc-b20a-1cddd78c32e1","product":{"name":"Open Source OpenClaw","vendor":{"name":"open source"}}}]}}]}