@openclaw/feishu vulnerabilities

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.

In the OpenClaw @openclaw/feishu library versions up to and including 2026.6.6, an incorrect authorization vulnerability was found where Feishu permission tools could ignore per-account disablement settings. This allows a lower-trust caller or configured input path to perform actions that should require stronger authorization. The issue is fixed in version 2026.6.9.

A vulnerability in the npm package @openclaw/feishu (versions up to 2026.6.6) allows ignoring per-account disablement. A lower-trust caller or a configured input path can perform actions requiring stronger authorization, leading to unauthorized operations. The issue is fixed in version 2026.6.9.