GHSA-98hh-7ghg-x6rqHighCVSS 8.8

OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals

Published
March 31, 2026
Last Modified
April 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-41303 →

📋 Description

Summary

Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist.

Impact

A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution.

Affected Component

extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts

Fixed Versions

  • Affected: <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 355abe5eba (Discord: enforce approver checks for text approvals).

🎯 Affected products1

  • npm/openclaw:<= 2026.3.24

🔗 References (5)