{"id":"CVE-2026-27484","aliases":["GHSA-wh94-p5m6-mr7j"],"url":"https://o3.security/vulnerability/CVE-2026-27484","summary":"OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows","details":"## Overview\n\nDiscord moderation action handling (`timeout`, `kick`, `ban`) used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context.\n\n## Impact\n\nIn setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user could request moderation actions by spoofing sender identity fields.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Latest published affected version (as of 2026-02-19): `2026.2.17`\n- Affected range: `<=2026.2.17`\n- Fixed in planned next release: `2026.2.18`\n\n## Fix\n\n- Moderation authorization now uses trusted sender context (`requesterSenderId`) instead of untrusted action params.\n- Added permission checks for required guild capabilities per action.\n\n## Fix Commit(s)\n\n- `775816035ecc6bb243843f8000c9a58ff609e32d`\n\nThanks @aether-ai-agent for reporting.","published":"2026-02-21T09:21:16.568Z","modified":"2026-08-12T03:51:34.804336172Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.18"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/775816035ecc6bb243843f8000c9a58ff609e32d","label":"openclaw/openclaw@7758160"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.19"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27484.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wh94-p5m6-mr7j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27484"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/775816035ecc6bb243843f8000c9a58ff609e32d"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:34.804336172Z"}}