{"id":"EUVD-2026-87469","enisaUuid":"abe75873-1638-3998-8f98-5f3f3f9ec53b","description":"OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator\u0027s read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.","datePublished":"Sep 26, 2026, 2:19:07 AM","dateUpdated":"Oct 8, 2026, 3:21:50 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g7fw-3gjp-g5hf\nhttps://www.vulncheck.com/advisories/openclaw-msteams-before-2026.8.1-channel-read-allowlist-bypass\n","aliases":"CVE-2026-100582\nGHSA-x2gp-w9p4-cpwg\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"1a9453b6-0e2b-39ba-859d-a2bd59d3287a","product":{"name":"googlechat","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.8.1"},{"id":"681d6a83-2f6b-39a6-9132-f8409e450601","product":{"name":"msteams","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.8.1"},{"id":"a434609a-2c25-3dc5-bf1b-37a8f405e33f","product":{"name":"feishu","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.8.1"},{"id":"cd65d17e-55fe-3c76-a6a4-6fd531858e1f","product":{"name":"Matrix","vendor":{"name":"VB-Audio Software"}},"product_version":"0 \u003c2026.8.1"}],"enisaIdVendor":[{"id":"827a8a94-9a98-3f61-ae1a-d9533b9ad4b8","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"3eeeba47-2ec9-375b-b144-62f9ac332b17","vulnerability":{"id":"GHSA-x2gp-w9p4-cpwg","description":"OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator\u0027s read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.","datePublished":"Sep 26, 2026, 3:30:27 AM","dateUpdated":"Sep 26, 2026, 3:30:27 AM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g7fw-3gjp-g5hf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100582\nhttps://www.vulncheck.com/advisories/openclaw-msteams-before-2026.8.1-channel-read-allowlist-bypass\n","enisa_id":"EUVD-2026-87469\n","aliases":"CVE-2026-100582\nGHSA-x2gp-w9p4-cpwg\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"46a4a583-d01d-312f-af01-3d21594d1f78","vulnerability":{"id":"CVE-2026-100582","description":"OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator\u0027s read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.","datePublished":"Sep 26, 2026, 2:19:07 AM","dateUpdated":"Oct 8, 2026, 3:21:50 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g7fw-3gjp-g5hf\nhttps://www.vulncheck.com/advisories/openclaw-msteams-before-2026.8.1-channel-read-allowlist-bypass\n","enisa_id":"EUVD-2026-87469\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 8, 2026, 7:15:17 AM","vulnerabilityProduct":[{"id":"a1cf923a-83ac-389d-9901-1302addb0400","product":{"name":"msteams","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.8.1"},{"id":"a2856a99-97bf-3ad4-b6af-071573f719ae","product":{"name":"googlechat","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.8.1"},{"id":"b0804c44-6dfa-39f4-9270-ef705bad6aff","product":{"name":"feishu","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.8.1"},{"id":"df6a1f41-ea94-3977-864a-daea055b2c57","product":{"name":"Matrix","vendor":{"name":"VB-Audio Software"}},"product_version":"0 \u003c2026.8.1"}],"vulnerabilityVendor":[{"id":"868ed846-613e-340e-81c2-916f461d4388","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[]}