OpenClaw before version 2026.9.4 contains an improper authorization flaw in the mcp.app.view method, allowing operators that possess only read scope (operator.read) to retrieve a standalone ticket and then redeem it at the MCP app view endpoint. This ticket grants the ability to invoke state‑changing tools that normally require full operator write permission (operator.write). The vulnerability is a direct authorization bypass, classified as CWE‑863, enabling attackers to modify system state without proper privilege checking.

This issue affects all installations of OpenClaw identified by the CNA vendor name "OpenClaw". No specific version range is listed in the supplied data, but the vulnerability exists in all releases prior to 2026.9.4. Users should verify whether their deployment is v2026.9.4 or earlier.

The CVSS score of 6 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Attackers need only a valid operator.read token, which is generally granted to read‑only users. By abusing this token they can elevate their privileges to perform write operations, leading to potential configuration changes or data manipulation. The exploitation process requires that the attacker is already authenticated with read access, a condition that may be common in many operational environments.