OpenClaw versions before 2026.3.12 contain an insufficient access‑control flaw that allows users who possess command authorization but are not owners to read or modify configuration settings that should be restricted to owners only. The weakness is an access‑control violation (CWE‑863). The result is that a non‑owner can access or change privileged settings that should only be reachable by owners, potentially compromising the integrity of the configuration.

The affected product is OpenClaw from OpenClaw. All releases prior to version 2026.3.12 are impacted. Systems using any earlier OpenClaw release should verify that the /config and /debug endpoints are protected or consider applying an update.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from the fact that the flaw is triggered by HTTP requests to exposed endpoints. Exploitation requires that an attacker already has command authorization, which may be available to ordinary users in some deployments. The absence of owner‑level checks makes the vulnerability exploitable under these conditions. Given the high severity and the relative ease of triggering the flaw via an authenticated session, immediate attention is warranted.