OpenClaw before 2026.4.12 contains a logic flaw that treats empty resolved approver lists as explicit approval. This allows an attacker who knows an approval id to resolve pending approvals without proper authorization or credentials. The flaw effectively bypasses approval controls, enabling unauthorized changes or actions within the system.

The affected product is OpenClaw from OpenClaw. Versions earlier than 2026.4.12 are affected. The flaw resides in the helper‑backed channels handling approval resolutions.

The CVSS score is 6, indicating moderate severity. No EPSS metric is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires knowledge of a valid approval identifier and access to the helper‑backed channel endpoint, which could be performed remotely if the application is exposed. Given the absence of low exploit probability metrics, the risk is considered moderate but should be mitigated promptly.