OpenClaw's Matrix integration (npm package @openclaw/matrix) normalizes Matrix user IDs to lowercase when building the authorization identity, causing distinct accounts that differ only by case or Unicode folding to resolve to the same identity. This permits a Matrix user that owns a colliding identifier to inherit the allowlist, owner-command, exec‑approval, or plugin‑approval privileges that were configured for another account, effectively bypassing authorization controls. The flaw is a case‑folding oversight (CWE‑178).

The vulnerability affects OpenClaw Matrix (npm package @openclaw/matrix) versions that are greater than or equal to 2026.2.2 and less than 2026.8.1. Any installation of the openclaw:matrix product within this version range is susceptible.

The vulnerability carries a CVSS score of 7.7, indicating moderate-to-high severity. Exploitability is not documented in EPSS or KEV, but the flaw can be leveraged by any user who can create or control a Matrix account that collides with a pre‑existing one, allowing that user to obtain elevated authorities on the target system. Attack requires authentication to Matrix and the ability to register or manage a colliding account, making the threat actionable to insiders or compromised accounts.