OpenClaw versions prior to 2026.2.25 fail to apply sender‑policy checks to reaction_* and pin_* non‑message events before adding them to the system‑event context, allowing an attacker to inject unauthorized reaction and pin events from restricted senders. This bypasses configured direct‑message policies and channel user allowlists, enabling malicious or deceptive actions within the workspace. The vulnerability does not provide remote code execution or arbitrary privilege escalation, but it undermines the integrity of event handling and can be used to mislead users or hide malicious activity.

The affected product is OpenClaw. Versions older than 2026.2.25 are impacted. Users running any release before 2026.2.25 that handles Slack reaction or pin events are at risk.

The CVSS score of 5.3 indicates medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely exploited yet. The likely attack vector involves external Slack events that the OpenClaw instance processes; an attacker can craft reaction or pin actions from a restricted sender to bypass policy checks, as inferred from the description. In the absence of a strong exploit, the risk is moderate but significant for environments relying on strict sender verification.