OpenClaw versions prior to 2026.4.8 contain a role bypass flaw in the device.token.rotate function that lets an attacker mint or preserve tokens for roles that have not been approved, thereby granting elevated privileges. This weakness is an imprecise authorization check (CWE-863) that can compromise role integrity and potentially give attackers broad access to protected scopes.

All OpenClaw deployments running any version earlier than 2026.4.8 on a Node.js platform are vulnerable; administrators and users interacting with the device.token.rotate API are at risk. The vulnerability impacts the OpenClaw application itself, which may be deployed in various device management environments.

The CVSS score of 7.7 indicates a high severity flaw. EPSS data is not available, but the lack of a KEV listing suggests no known active exploitation at the time of this analysis. The likely attack vector involves an authenticated user submitting requests to the token rotation endpoint, exploiting the missing approval check; therefore the flaw is exploitable in realistic operational contexts where such endpoints are exposed.