The vulnerability allows attackers to control phone channel state by arming or disarming them without required administrative rights. The flaw originates from missing operator.admin scope validation in the /phone arm and /phone disarm endpoints of OpenClaw versions prior to 2026.3.28. Consequently, an unauthorized user could enable or disable external phone channels, potentially disrupting connectivity or facilitating further lateral movement.

OpenClaw before version 2026.3.28. The product is OpenClaw, operated on Node.js.

Based on the description, it is inferred that the flaw can be exploited by any user with limited rights or even unauthenticated traffic. Attackers would send simple HTTP requests to the /phone arm or /phone disarm endpoints, as the lack of operator.admin scope checks permits. No advanced techniques are required. The CVSS score of 7.1 and the fact that it is not listed in the KEV catalog indicate a significant risk, especially in environments where OpenClaw manages critical voice or telecom infrastructure.