← Back

CVE-2026-53863

nvd nist
Published: Jun 16, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.0
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, potentially bypassing intended access controls.

Affected (12)

Products: Openclaw: Openclaw
Openclaw
1 product
Openclaw
Configuration A
12 vulnerable
Vulnerable SoftwareAffected Versions
Openclaw
Openclaw
Before 2026.4.25
Openclaw
Version 2026.4.25 beta10
Openclaw
Version 2026.4.25 beta11
Openclaw
Version 2026.4.25 beta1
Openclaw
Version 2026.4.25 beta2
Openclaw
Version 2026.4.25 beta3
Openclaw
Version 2026.4.25 beta4
Openclaw
Version 2026.4.25 beta5
Openclaw
Version 2026.4.25 beta6
Openclaw
Version 2026.4.25 beta7
Openclaw
Version 2026.4.25 beta8
Openclaw
Version 2026.4.25 beta9

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

Source: disclosure@vulncheck.com
Vendor AdvisoryMitigation
Source: disclosure@vulncheck.com
Third Party Advisory

Timeline

No history available yet.