OpenClaw Authorization Bypass Vulnerability in Reaction Events Misclassification

An authorization bypass vulnerability has been identified in OpenClaw versions prior to 2026.3.12. The issue arises in Feishu reaction events that omit the 'chat_type', leading to a misclassification of group conversations as peer-to-peer (p2p). This misclassification allows attackers to bypass 'groupAllowFrom' and 'requireMention' protections in group chat reaction-derived events.

Impact

Exploitation of this vulnerability can lead to unauthorized bypassing of group chat reaction event protections, allowing for potential misuse of reaction events in group conversations.

Remediation

Users are advised to update OpenClaw to version 2026.3.12 or later, where this vulnerability has been fixed.