An access control flaw in the signal reaction notification handling permits a sender lacking proper authorization to enqueue status events before enforcement checks are applied. This oversight allows an attacker to inject reaction status lines into the system, potentially corrupting data integrity or displaying false updates to users. The weakness corresponds to an authorization bypass weakness.

All OpenClaw releases older than version 2026.2.25 are affected, including deployments that use the event-handler logic for reaction-only events. The vulnerability applies to the OpenClaw application running on Node.js environments as described by the affected CPE.

The issue carries a severity rating of 6.3 and no publicly available exploitation probability is reported. It is not part of the known-exploited vulnerability catalog. The likely attack path involves a remote request to the reaction event endpoint, where the bypass can be exercised without additional privileges. No active exploitation evidence has been documented, but the potential to inject unauthorized status sequences presents a moderate risk to data integrity and system behavior.