GHSA-gw2c-6hcg-5g52

Source

https://github.com/advisories/GHSA-gw2c-6hcg-5g52

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-gw2c-6hcg-5g52/GHSA-gw2c-6hcg-5g52.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gw2c-6hcg-5g52

Withdrawn

2026-06-18T20:34:29Z

Published

2026-06-16T21:31:58Z

Modified

2026-06-18T20:45:17Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: Focus command could miss controlScope enforcement

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mpc8-jxjh-qpgh. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels.

Database specific

{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-18T20:34:29Z",
    "nvd_published_at":  "2026-06-16T19:17:02Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2026.4.24

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-gw2c-6hcg-5g52/GHSA-gw2c-6hcg-5g52.json"