The vulnerability occurs in OpenClaw versions prior to 2026.3.12 when operating in Zalouser allowlist mode. The system incorrectly relies on mutable group display names rather than permanent identifiers to enforce access permissions. An attacker who can create a group with a display name identical to an allowlisted group can trick the system into treating the new group as authorized, permitting the delivery of messages through channels that should be protected and bypassing channel authorization.

Affected systems are installations of the OpenClaw server software with a version earlier than 2026.3.12. This includes all deployments of the open source OpenClaw product; no other vendor or product is mentioned.

The CVSS score for this issue is 6.9, indicating medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to create or modify group entities in the application, which can typically be performed via the exposed APIs or administrative interface. It is inferred that an attacker would need remote network access to the OpenClaw instance with permission to create groups. Given the medium CVSS and the lack of evidence of active exploitation, the risk is significant but not imminently critical.