CVE-2026-62196

A WhatsApp group ID can authorize an elevated OpenClaw sender

OpenClaw · OpenClaw WhatsApp elevated sender allowlist

First documented disclosure · Review checkpoint

Summary

A lower-trust group participant can inherit an elevated permission intended for a particular sender.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The project describes the authorization bypass. The reviewed disclosures do not report a malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The elevated-sender check could accept a group identity as the identity of the individual asking for an action.

Conditions required

The affected WhatsApp path is reachable and the operator has configured the relevant elevated allowlist.

Potential impact

An action can run with authority the individual sender was never granted. Impact depends on the operator’s enabled features.

Affected versions and configurations

From 2026.3.22 up to, but excluding, 2026.6.6.

Fix and mitigation status

OpenClaw identifies 2026.6.6 as the first stable fix.

Practical next steps

Upgrade or disable elevated group requests until patched. Confirm an unlisted group member cannot perform the privileged action.

Operating lesson

Authorize the person taking the action independently of their messaging group.

Evidence and limits

The public fix proposal dates to June 9, release to June 12 and maintainer advisory to June 30. VulnCheck published the CVE July 13 and gives it 8.7 on CVSS 4.0. The maintainer advisory scores 8.3 on CVSS 3.1.

Sources