OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption

View on GitHub ↗

Description

Summary

In openclaw MS Teams file-consent flow, pending uploads were authorized by uploadId alone. fileConsent/invoke did not verify the invoke conversation against the conversation that created the pending upload.

Impact

An attacker who obtained a valid uploadId within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path).

Technical Details

  • Pending uploads stored conversationId, but invoke handling consumed by uploadId only.
  • The invoke path did not enforce conversation binding before uploadToConsentUrl(...) and pending-upload removal.
  • Fix binds accept/decline handling to normalized conversation id match before consuming pending upload state.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published npm version (as of February 26, 2026): 2026.2.24
  • Vulnerable range: <= 2026.2.24
  • Patched in release: 2026.2.25

Remediation

Upgrade to openclaw 2026.2.25 (or later) once published.

Fix Commit(s)

  • 347f7b9550064f5f5b33c6e07f64e85b9657b6f1

Release Process Note

patched_versions is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2026-03-03 21:36:49 UTC
Updated
2026-03-03 21:36:50 UTC
GitHub reviewed
2026-03-03 21:36:49 UTC

CVSS Scores

Base score Version Severity Vector
5.3 4.0 —
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network.
Attack complexity (AC:L)
Exploitation conditions are straightforward and stable.
Attack requirements (AT:N)
No additional preconditions are required beyond normal reachability.
Privileges required (PR:L)
Low privileges are required.
User interaction (UI:N)
No user interaction is required.
Vulnerable system confidentiality impact (VC:N)
No confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:L)
Limited integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:N)
No availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:N)
No confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:N)
No integrity impact on subsequent systems.
Subsequent system availability impact (SA:N)
No availability impact on subsequent systems.

Identifiers

Type Value
GHSA GHSA-j26j-7qc4-3mrf ↗

CWEs

CWE id Name
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-862 Missing Authorization

Credits

  • tdjackey (reporter)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
npm openclaw <= 2026.2.24 2026.2.25 —

References

cvelogic Threat Intelligence