OpenClaw Authorization Bypass Vulnerability in Discord Guild Reaction Ingestion

A vulnerability allowing authorization bypass has been identified in OpenClaw versions prior to 2026.3.11. This issue arises in the Discord guild reaction ingestion process, where the application fails to properly enforce allowlist checks for member users and roles. As a result, non-allowlisted guild members can trigger reaction events that are treated as trusted system events, injecting reaction text into the session context downstream.

Impact

Exploitation of this vulnerability allows non-allowlisted guild members to bypass authorization checks, injecting unauthorized reaction text into session contexts as trusted system events.

Remediation

Users are advised to upgrade to OpenClaw version 2026.3.11 or later.