The vulnerability in OpenClaw’s Feishu unpin feature arises because the native chatId parameter is not declared as a delivery target. This omission allows an authenticated sender to craft an unpin request that bypasses the cross‑context target check whenever the tools.message.crossContext.allowWithinProvider setting is turned off. The result is that a user who has access to a group can remove a pinned message from another group, violating the intended policy. This is a case of improper access control (CWE‑863), exposing unauthorized message mutation capabilities.

Affected software is OpenClaw from version 2026.6.9 up to, but not including, 2026.8.1. Versions prior to 2026.6.9 or 2026.8.1 and later are not impacted. Any deployment using the identified version range that integrates with Feishu must be reviewed, as the flaw resides in the unpin operation handling within the platform.

The CVSS base score of 5.3 indicates a medium severity risk. EPSS information is not available, but because the issue requires authenticated access and a specific configuration toggle, the likelihood of widespread exploitation is moderate. The flaw is not catalogued in the CISA KEV list, and no public exploits have been reported. Attacks would involve an authenticated user forging an unpin request to another group, and while group membership and authorization still apply, the policy that should prevent such cross‑context mutations is bypassed. Administrators should treat this as a medium‑risk exposure that can affect policy compliance.