CVE-2026-62224: OpenClaw MS Teams < 2026.5.12 Authorization Bypass

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-17 · updated 2026-10-24
Weakness: CWE-290

Description

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.

Affected products

openclaw msteams: before 2026.5.12 — fixed in 2026.5.12

How to fix

Upgrade to a fixed version: openclaw msteams 2026.5.12. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-7w4v-g4m6-j88v
https://www.vulncheck.com/advisories/openclaw-ms-teams-authorization-bypass

Get alerted when CVE-2026-62224 or the next vulnerability affects your stack