OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability. The flaw arises when DM pairing-store identities are incorrectly treated as group allowlist identities while the configuration dmPolicy=pairing and groupPolicy=allowlist are active. A remote attacker can send messages and reactions using those DM‑paired identities even if the target user is not a member of the group’s allowlist, effectively bypassing group sender authorization checks and impersonating other users in group chats. This weakness is categorized as CWE-863, which describes improper validation of authorization attributes.

The vulnerability affects all deployments of the OpenClaw product that are running a version earlier than 2026.2.26. No further sub‑version details are provided beyond the "< 2026.2.26" threshold. The affected vendor is OpenClaw.

The CVSS v3.10 score is 2.3, indicating low severity. EPSS data is not reported, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is explicitly remote, as the description states that attackers can send messages to DM‑paired identities. While the impact is mainly the ability to impersonate users within group chats, and does not affect confidentiality or integrity of stored data, the potential for social engineering checks means it should still be addressed in a timely manner.