CVE-2026-62224: OpenClaw MS Teams < 2026.5.12 Authorization Bypass
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62224?
The severity of CVE-2026-62224 is rated as low with a score of 2.3.
How do I fix CVE-2026-62224?
To fix CVE-2026-62224, upgrade OpenClaw MS Teams to version 2026.5.12 or later.
What are the risks associated with CVE-2026-62224?
The risks associated with CVE-2026-62224 include potential unauthorized actions by attackers with lower-trust access.
What components are affected by CVE-2026-62224?
CVE-2026-62224 affects the allowFrom feature of OpenClaw MS Teams versions before 2026.5.12.
Can CVE-2026-62224 be exploited remotely?
Yes, CVE-2026-62224 has the potential for remote exploitation due to its access characteristics.