OpenClaw before version 2026.3.24 contains an incorrect authorization flaw in the POST /reset-profile endpoint that allows authenticated users with operator.write permissions on the browser.request interface to bypass profile mutation checks. This gives them the ability to stop the browser, close Playwright connections, and move profile directories to Trash, effectively elevating their privileges beyond the intended scope.

The vulnerable product is the OpenClaw application; all releases prior to 2026.3.24 are affected, and the flaw impacts the POST /reset-profile route exposed through the browser.request surface.

The issue scores a CVSS base of 7.2, indicating high severity. Exploit requires valid credentials with operator.write rights; once obtained, the attacker can directly trigger the vulnerability in the browser, enabling privilege escalation. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the existing impact and relative ease of exploitation recommend prompt remediation.