OpenClaw LINE versions prior to 2026.8.1 contain an access control flaw in which the group allowlist mode inadvertently inherits DM allowFrom settings when the groupAllowFrom option is not explicitly configured. This flaw means that an attacker who is a member of a group can cause the agent to activate even though the group allowlist should restrict access, allowing them to bypass intended access controls. The vulnerability is a CWE-863 issue involving improper authorization. The impact is the loss of confidentiality, integrity, and availability of the managed assets that are controlled by the LINE platform; an attacker can cause an unauthorized agent execution on any endpoint that falls under the broader DM access rights.

The affected product is OpenClaw LINE, with all releases before version 2026.8.1. Any deployment of these earlier releases is vulnerable. The vendor is openclaw, and the specific product name is LINE.

The CVSS score of 6.9 indicates medium severity, and the EPSS score is not available, providing no clear measure of exploit likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the platform's network interface where an attacker who can participate in a group could trigger the agent. Exploitation requires that the attacker is a member of a group and that the DM allowFrom permissions are broader than the intended group access. No public exploit evidence is reported, but the potential exists for moderate risk in environments with exposed access points.