lowCVSS 3.7Vulnerability

GHSA-r849-826x-wgqm

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wm8r-w8pf-2v6w. This link is maintained to preserve external references. ## Original Description OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.

Properties

ghsa_id
GHSA-r849-826x-wgqm
severity
low
summary
Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage
cvss_score
3.7
cve_id
GHSA-r849-826x-wgqm
cvss_vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
is_ghsa_only
true
ghsa_published
2026-03-19T03:30:57Z
source_url
https://github.com/advisories/GHSA-r849-826x-wgqm
ghsa_updated
2026-03-20T13:40:04Z

Related Entities (3)

AFFECTS (1)

[Software]npm/OpenClaw

HAS_WEAKNESS (1)

[Weakness]Incorrect Authorization

REPORTED_BY (1)

[Source]GitHub Advisory Database

Explore deeper with Ninja Signal's threat intelligence graph

GHSA-r849-826x-wgqm (CVSS 3.7) — Ninja Signal Threat Intelligence | Ninja Signal