OpenClaw before 2026.3.12 contains an authorization bypass that occurs when Feishu reaction events omit the 'chat_type' field. The missing field causes the system to treat the event as a peer‑to‑peer conversation instead of a group chat, allowing the attacker to trigger group‑level protections such as groupAllowFrom and requireMention without appropriate authorization.

This issue affects the OpenClaw application installed on any Node.js runtime with a version earlier than 2026.3.12. All deployments using the earlier releases are susceptible until the application is updated.

The CVSS score is 6.9, indicating a high impact when exploitation succeeds. EPSS data is not available, and the vulnerability is not listed in the KEV catalog. The exploit requires the attacker to send a crafted Feishu reaction event that lacks the chat_type value, a scenario that can be achieved remotely if the target has internet connectivity and can receive Feishu events. No additional prerequisites are noted, making the vulnerability relatively straightforward to exploit for an attacker who can generate such events.