CVE-2026-62188
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In the OpenClaw @openclaw/feishu library versions up to and including 2026.6.6, an incorrect authorization vulnerability was found where Feishu permission tools could ignore per-account disablement settings. This allows a lower-trust caller or configured input path to perform actions that should require stronger authorization. The issue is fixed in version 2026.6.9.
Risk Assessment
The risk involves potential bypass of access controls, enabling unauthorized actions by an attacker with lower trust, which could lead to data confidentiality or integrity breaches within the organization.
Recommendation
Immediately update the @openclaw/feishu library to version 2026.6.9 or later. If possible, temporarily disable the Feishu permission tools feature before applying the update.
Other vulnerabilities in @openclaw/feishu
See all- CVE-2026-100540Medium
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
- CVE-2026-62187High
A vulnerability in the npm package @openclaw/feishu (versions up to 2026.6.6) allows ignoring per-account disablement. A lower-trust caller or a configured input path can perform actions requiring stronger authorization, leading to unauthorized operations. The issue is fixed in version 2026.6.9.
Original NVD description (English source)
OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in version 2026.6.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS