The flaw appears when the chat.send endpoint does not enforce owner‑only restrictions on infrastructure tools. A non‑owner user with write scope can initiate a chat turn that includes the gateway and cron tools, allowing an agent to execute owner‑only configuration or scheduling operations that alter persistent state. This represents a privilege escalation consistent with CWE‑269.

Any deployment of the openclaw npm package prior to version 2026.7.1 is affected. The vulnerability exists in Gateway deployments that honor caller identity and narrower operator scopes. Versions 2026.7.1 and later contain the fix; earlier releases remain vulnerable.

With a CVSS score of 7.2 the risk is moderate to high. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack requires an authenticated user with write‑scoped access to chat.send; however, by steers the model or selecting privileged tools, the attacker can induce unauthorized configuration changes. Prompt updating to the fixed release is advised, while temporary controls can mitigate the exposure.