CVE-2026-32923: OpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allowlist checks. Non-allowlisted guild members can trigger reaction events accepted as trusted system events, injecting reaction text into downstream session context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32923?
CVE-2026-32923 is considered a high severity vulnerability due to its potential for unauthorized access to Discord guild reactions.
How do I fix CVE-2026-32923?
To remediate CVE-2026-32923, upgrade OpenClaw to version 2026.3.11 or later to ensure authorization checks are enforced.
What type of vulnerability is CVE-2026-32923?
CVE-2026-32923 is an authorization bypass vulnerability that affects the Discord guild reaction allowance in OpenClaw.
Who is affected by CVE-2026-32923?
Users of OpenClaw versions prior to 2026.3.11 are affected by CVE-2026-32923, specifically regarding discord guild member role enforcement.
What is the impact of CVE-2026-32923?
The impact of CVE-2026-32923 allows non-allowlisted guild members to react inappropriately, potentially leading to unauthorized actions within Discord guilds.