OpenClaw versions between 2026.5.2 and 2026.8.1 contain a broken authorization flaw that allows a group member who normally cannot use command‑based functions to issue the "/new <model>" command. The command resets the shared group session and lets the attacker persist a provider and model override. As a result, the attacker can shift provider routing, change model selection, alter costs, and influence data flow for all subsequent interactions in the group, all without the operator’s explicit permission. This vulnerability does not grant command execution or the ability to add new providers, but it does allow a denial‑of‑authorization user to control core operating parameters in a shared session.

The vulnerability affects the OpenClaw npm package named openclaw. Affected releases include any version starting at 2026.5.2 up to, but not including, 2026.8.1. Users running these versions in WhatsApp group handling contexts are at risk.

The CVSS score of 5.3 indicates a moderate severity impact. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting limited evidence of widespread exploitation. The attack vector is inferred to be via a normal group chat where the attacker is a member and can send commands; thus, the user must have legitimate group membership and knowledge of the "/new" command. Exploitation requires no special privileges beyond group membership, so the likelihood of successful exploitation is moderate but constrained to environments where OpenClaw is deployed for group command handling.