The vulnerability allows a message sender with a lower trust level to read guild metadata information that should be protected by channel allowlists. By bypassing the Discord read‑target policy, an attacker can access metadata from servers or channels that are not on the operator’s allowed list. This is a direct access‑control weakness (CWE‑862) that enables unauthorized disclosure of configuration or configuration data that may be sensitive.

OpenClaw Discord instances running any version before 2026.7.1 are vulnerable. Users of the openclaw:discord product should verify their running version and update if necessary.

The vulnerability receives a CVSS score of 5.3, indicating a moderate risk overall. No EPSS score is available and the issue is not listed in CISA KEV, so the current exploitation probability is uncertain. The attack vector is likely remote through normal Discord interactions, where an attacker can send a message from a lower‑trust channel and read protected guild metadata. The lack of an exploit proof of concept in public sources suggests exploitation may require some discovery effort but is plausible for determined actors.