{"id":"GHSA-chm2-m3w2-wcxm","aliases":[],"url":"https://o3.security/vulnerability/GHSA-chm2-m3w2-wcxm","summary":"OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch","details":"### Summary\nGoogle Chat allowlisting supports matching by sender email in addition to immutable sender resource name (`users/<id>`). This weakens identity binding if a deployment assumes allowlists are strictly keyed by immutable principals.\n\n### Affected Packages / Versions\n(As of 2026-02-14; based on latest published npm versions)\n- `openclaw` (npm): `<= 2026.2.13`\n- `clawdbot` (npm): `<= 2026.1.24-3`\n\n### Details\nAffected component:\n- `extensions/googlechat/src/monitor.ts`\n\nThe `allowFrom` checks accept:\n- Immutable sender id (`users/<id>`)\n- Raw email (`alice@example.com`) for usability\n\nHistorically, `users/<email>` was also treated as an email allowlist entry. This is now deprecated because it looks like an immutable ID but is actually a mutable principal.\n\n### Security Triage (2026-02-14)\nSeverity: **Low**\n\nRationale:\n- Requests are authenticated as coming from Google Chat (token verification), so this is not a generic unauthenticated spoofing vector.\n- A realistic exploit generally requires **Google Workspace / IdP administrative control** over identity lifecycle (e.g. reassigning an email address to a different underlying account) to obtain the same email with a different `users/<id>`.\n- With that level of access, the attacker typically has broader compromise paths.\n\nWe still treat it as a valid defense-in-depth report because accepting mutable principals in authorization decisions can increase risk in chained-failure scenarios.\n\n### Remediation / Behavior Changes\nGoal: preserve usability while reducing footguns.\n- Raw email allowlists remain supported.\n- `users/<email>` is deprecated and treated as a **user id**, not as an email allowlist.\n- Documentation recommends `users/<id>` when strict immutable binding is required.\n\n### Fix Commit(s)\n- `c8424bf29a921e25663b29f308640b3d91a49432` (PR #16243)\n\nThanks @vincentkoc for reporting.","published":"2026-02-17T22:56:39Z","modified":"2026-02-17T23:03:09.952325Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.14"},{"ecosystem":"npm","name":"clawdbot","fixedVersion":null}],"fix":{"url":"https://github.com/openclaw/openclaw/pull/16243","label":"openclaw/openclaw#16243"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chm2-m3w2-wcxm"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/pull/16243"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/c8424bf29a921e25663b29f308640b3d91a49432"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-17T23:03:09.952325Z"}}