CVE-2026-19007

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19007

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19007.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19007

Published

2026-08-06T06:15:08.258Z

Modified

2026-08-08T03:48:17.773988748Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management

Details

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cwe_ids": [
        "CWE-266",
        "CWE-269"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19007.json"
}

References

Affected packages

Git / github.com/mf-yang/openclaw-cn

Affected ranges

Type

GIT

Repo

https://github.com/mf-yang/openclaw-cn

Events

Introduced

1b9f16468d9841871cb15103693c3923424c9842

Last affected

558f272e6c90e7e0c37644e505e161b91ef738f0

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        },
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        }
    ]
}

Affected versions

0.*

0.2.0

0.2.1

v0.*

v0.2.0

v0.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19007.json"