CVE-2026-62187

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue is fixed in version 2026.6.9. Impact depends on the operator's configuration and whether lower-trust input can reach the affected feature.

• CWE-863

• https://github.com/openclaw/openclaw/security/advisories/GHSA-2q7j-2vhx-56g8Vendor Advisory
• https://www.vulncheck.com/advisories/openclaw-feishu-tools-authorization-bypassThird Party Advisory

Published

Jul 13, 2026

Last Modified

Jul 15, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62180Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-62182KubeEdge is an open source system for extending native conta…8.8
• CVE-2026-62183Improper Privilege Management vulnerability in Apache Syncop…9.8
• CVE-2026-62184luci-app-banip contains a log parsing vulnerability where th…8.7
• CVE-2026-62185Argo CD Helm Chart before 10.0.0 fails to install network po…8.6
• CVE-2026-62186OpenClaw versions before 2026.6.8 contain an authorization b…7.6
• CVE-2026-62188OpenClaw @openclaw/feishu versions 2026.6.6 and earlier cont…8.6
• CVE-2026-62189OpenClaw versions before 2026.6.9 contain a symlink followin…7.6
• CVE-2026-6219A vulnerability was determined in aandrew-me ytDownloader up…5.3
• CVE-2026-62190OpenClaw versions before 2026.6.9 contain an authorization b…8.8
• CVE-2026-62191OpenClaw versions 2026.6.6 before 2026.6.9 contain an author…7.1
• CVE-2026-62192OpenClaw versions 2026.6.6 before 2026.6.9 contain an author…8.1