Technical impact
The vulnerability allows non-owner external-channel users to invoke the "/voice set" command and persist gateway voice configuration changes, without revealing credentials or obtaining additional host privileges. This enables attackers to alter the voice used by Talk responses for the configured provider, compromising configuration integrity and potentially disrupting service behavior. The weakness originates from inadequate access control for the voice configuration command (CWE-863).
Affected Systems
Vendors: OpenClaw, product: OpenClaw. All releases prior to version 2026.7.1 are affected by this authorization bypass in the /voice set command.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate to high risk of exploitation. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must have the ability to send commands through an external channel that is not owned by them; from that baseline the weakness permits bypass of the intended authorization controls. Because the exploit requires command access, the attack vector is inferred to be through authenticated or otherwise privileged channels that allow submission of service commands. The impact is limited to configuration integrity and does not involve credential compromise or elevation of host privileges.
