The vulnerability is a failure to validate whether a configured default account is disabled before using it for model tool operations. Attackers can exploit multi‑account configurations where the default account is disabled but its credentials remain in the system. By doing so, they can read or modify Feishu resources using a revoked identity, effectively bypassing authentication checks.

The product affected is OpenClaw Feishu software from OpenClaw. The flaw exists in all releases before version 2026.8.1. Organizations running any earlier version of the Feishu client should consider themselves impacted.

The CVSS base score of 7.6 indicates high impact, but the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack path requires an attacker who has preexisting access to the multi‑account environment; from there they can leverage the disabled account’s stored credentials to access resources normally protected by authentication. Because the flaw permits access to data or resources outside the intended permissions, the risk is significant for any organization that stores sensitive information on Feishu.