CVE-2026-100531

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100531
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100531.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100531
Aliases
  • GHSA-v7hh-7676-rg67
Published
2026-09-26T02:18:32Z
Modified
2026-09-27T03:48:40Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
openclaw Slack before 2026.8.1 Authorization Bypass
Details

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a single conversation who knows or obtains a file identifier can therefore download file contents from outside that conversation's scope, disclosing data across configured conversation boundaries. The issue does not allow listing arbitrary Slack files and does not bypass Slack authentication itself. The issue is fixed in version 2026.8.1.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100531.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea806575e6450e4d1efdfc72c19f04be982a1b9b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

Other
release-publish/08987d8f409b-20260717
release-publish/0e9db600595-20260717
release-publish/0e9db6005954-20260717
release-publish/0f7fbfa0039f-20260715
release-publish/10a390ed7fa8-20260802
release-publish/17a1225314cd-1787924262
release-publish/1c80cf86cfd0-1787823217
release-publish/1d2777548d01-20260715
release-publish/2133a924eef0-1787945469
release-publish/21b41efc7bb8-1787818100
release-publish/23d2f664fb75-20260715
release-publish/38fd9ad6e417-1787824804
release-publish/404719374e60-1787933925
release-publish/4074a8b44d89-1787849600
release-publish/45ed68e6ea62-1787220256
release-publish/468054f93c43-1787921799
release-publish/491769bded58-1787929537
release-publish/5090935817e3-1787842724
release-publish/54f70c5d8c04-20260715
release-publish/556a2ee276f0-20260718
release-publish/57fabb2c9c35-1786621048
release-publish/5cb2eee257bc-1787929587
release-publish/5cb2eee257bc-1787929714
release-publish/5dca33a8fb67-20260802
release-publish/62c77b0fb51c-1787927225
release-publish/6ddb9f049fb3-1787938179
release-publish/716f996be8db-1786550775
release-publish/728084497329-20260801
release-publish/73d04395defe-20260717
release-publish/7c9794b5c65c-20260801
release-publish/8371831eba5e-1786610071
release-publish/8858944a81c5-20260717
release-publish/8afa8f339eb6-1787798436
release-publish/9b80f9a8b1df-20260717
release-publish/9bc3c2955500-20260802
release-publish/a33c8a5c0ec6-1787896022
release-publish/a84a915b67bd-1787933964
release-publish/a9ac13b2efd7-20260717
release-publish/abd63c06c2f5-1786646045
release-publish/b3986403ddb9-1787938102
release-publish/bb1a7e506927-20260715
release-publish/bccb649077f0-1787900300
release-publish/c28c279afa37-1787225611
release-publish/c3927271fad7-20260715
release-publish/c96e81375014-1787462685
release-publish/ced50f88e928-20260717
release-publish/d5412d73acfb-1787906286
release-publish/d8b3e1c093f2-20260715
release-publish/d8dd59bf8f60-20260717
release-publish/deffca656500-20260801
release-publish/dfa246e6fd16-20260715
release-publish/e11c566824b1-1787940135
release-publish/eb8c22ed13f9-20260801
release-publish/ebc70fa1b3f6-1787634336
release-publish/f4987deb94b8-1786361493
release-publish/f4f5bb15d46a-20260715
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v1.*
v1.0.4
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v2.*
v2.0.0-beta1
v2.0.0-beta2
v2.0.0-beta3
v2.0.0-beta4
v2.0.0-beta5
v2026.*
v2026.1.10
v2026.1.11
v2026.1.11-1
v2026.1.11-2
v2026.1.11-3
v2026.1.12
v2026.1.12-2
v2026.1.13
v2026.1.14-1
v2026.1.15
v2026.1.16-2
v2026.1.20
v2026.1.21
v2026.1.22
v2026.1.23
v2026.1.24
v2026.1.24-1
v2026.1.29
v2026.1.30
v2026.1.5
v2026.1.5-1
v2026.1.5-2
v2026.1.5-3
v2026.1.8
v2026.1.9
v2026.2.1
v2026.2.12
v2026.2.13
v2026.2.14
v2026.2.15-beta.1
v2026.2.17
v2026.2.19
v2026.2.19-beta.1
v2026.2.2
v2026.2.21
v2026.2.21-beta.1
v2026.2.22
v2026.2.22-beta.1
v2026.2.23
v2026.2.23-beta.1
v2026.2.24
v2026.2.24-beta.1
v2026.2.25
v2026.2.25-beta.1
v2026.2.26
v2026.2.26-beta.1
v2026.2.3
v2026.2.6
v2026.2.6-1
v2026.2.6-2
v2026.2.6-3
v2026.2.9
v2026.3.1
v2026.3.11
v2026.3.11-beta.1
v2026.3.12
v2026.3.13
v2026.3.13-1
v2026.3.2
v2026.3.2-beta.1
v2026.3.22
v2026.3.22-beta.1
v2026.3.23
v2026.3.23-2
v2026.3.23-beta.1
v2026.3.24
v2026.3.24-beta.1
v2026.3.24-beta.2
v2026.3.28
v2026.3.28-beta.1
v2026.3.31
v2026.3.31-beta.1
v2026.3.7
v2026.3.7-beta.1
v2026.3.8
v2026.3.8-beta.1
v2026.4.1
v2026.4.1-beta.1
v2026.4.10
v2026.4.11
v2026.4.11-beta.1
v2026.4.12
v2026.4.12-beta.1
v2026.4.14
v2026.4.14-beta.1
v2026.4.15
v2026.4.15-beta.1
v2026.4.15-beta.2
v2026.4.19-beta.1
v2026.4.19-beta.2
v2026.4.2
v2026.4.5
v2026.4.7
v2026.4.7-1
v2026.4.8
v2026.4.9
v2026.4.9-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100531.json"