OpenClaw Authorization Bypass Vulnerability in Microsoft Teams Feedback Invoke

A vulnerability allowing authorization bypass in Microsoft Teams feedback invokes has been identified in OpenClaw versions prior to 2026.3.25. This vulnerability allows unauthorized senders to record session feedback by bypassing sender allowlist checks through feedback invoke endpoints.

Impact

Exploitation of this vulnerability allows unauthorized recording of feedback or triggering of feedback reflection for sessions, bypassing established sender authorization protocols.

Reproduction

The vulnerability can be reproduced by sending a feedback invoke from an unauthorized sender in a direct message or group chat. The feedback will be recorded, and any associated reflection will be triggered, despite the sender not being on the allowlist.

Remediation

Users can update to OpenClaw version 2026.3.25 or later to address this vulnerability.