This vulnerability allows an attacker to bypass the group reaction access control that normally requires a mention. By sending reaction events to a mention‑gated group, the attacker can trigger the creation of agent‑visible system events that are normally restricted. This creates an unauthorized execution path wherein restricted system actions become visible to the attacker. The weakness is an authorization bypass (CWE‑288).

The affected product is OpenClaw. Versions earlier than 2026.3.25 contain the flaw. No specific sub‑version list is provided, so all releases prior to 2026.3.25 are impacted.

The CVSS score of 5.3 indicates a medium severity risk. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via routine use of group reactions, which may be done from any member of a group that uses mention gating, so the attack vector is likely application‑level and remote. Because the flaw permits unauthorized exposure of system events, it can lead to information disclosure or potential disruption of services.