OpenClaw before version 2026.3.22 has a webhook path route replacement issue in the Synology Chat extension that lets an attacker collapse multiple account configurations onto shared webhook paths. By doing so, the attacker can bypass per‑account direct message access controls and take over route ownership across accounts, allowing them to read or send messages in accounts they do not own. The weakness falls under CWE‑706 and CWE‑863.

This vulnerability affects the OpenClaw platform when used in the Synology Chat extension. All installations running an OpenClaw version earlier than 2026.3.22 are potentially impacted. The affected software runs on a Node.js environment as indicated by the CPE entry.

The CVSS score of 6.3 indicates a moderate severity, and the vulnerability is considered exploitable over network channels that provide access to the Synology Chat webhook endpoint. No explicit exploit conditions were listed, but the attack vector is inferred to be remote via crafted HTTP requests to the webhook path. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score of less than 1 % suggests a low probability of exploitation but still warrants attention.