The @openclaw/slack npm package prior to version 2026.8.1 contains an authorization flaw in its Slack download‑file handler. If a file lacks the share metadata that links it to the requested conversation, the conversation‑authorization check fails, enabling an authenticated user with access to only one conversation to download file contents from outside that conversation. The flaw does not let an attacker list arbitrary Slack files or bypass Slack’s own authentication, but it can leak data across conversation boundaries. The weakness corresponds to CWE‑639, unauthorized data disclosure due to improper authorization.

The vulnerability affects the openclaw:slack npm package, specifically all releases earlier than 2026.8.1. Users running any version before 2026.8.1 that includes the Slack download‑file handler are susceptible.

The CVSS score of 7.1 indicates a moderate severity with potential confidentiality impact. EPSS is currently unavailable, so risk to active exploitation cannot be quantified precisely, and the item is not listed in the CISA KEV catalog. Exploitation requires an authenticated caller that has been granted permission for a single conversation and must know or guess a file identifier that belongs to a different conversation. Because the attack route relies on known conversation membership and file IDs, the threat surface is limited, yet the data exposed can be sensitive. The flaw does not affect Slack’s own authentication mechanism, so the only vector is the package’s API.