Feishu (< 2026.6.9-Beta.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/feishu--2026.6.9-beta.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 03 Sep 2026 18:04:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in OpenClaw Feishu Packagehttps://feed.craftedsignal.io/briefs/2026-09-openclaw-feishu-auth-bypass/Thu, 03 Sep 2026 18:04:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-openclaw-feishu-auth-bypass/The OpenClaw feishu package is susceptible to an authorization bypass vulnerability where per-account disablement settings are ignored, potentially allowing lower-trust entities to execute unauthorized actions.The OpenClaw feishu package (version < 2026.6.9-beta.1) contains an authorization bypass vulnerability that causes the software to ignore per-account disablement configurations. This defect permits a lower-trust caller or a reachable input path to execute operations that should have been restricted by the intended authorization or security policy. Because the Feishu module interacts with external messaging and collaboration services, this flaw poses a significant risk to organizations where Gateway operators may be exposed to untrusted inputs or where service accounts share gateways across different trust boundaries. This vulnerability does not impact the core trusted-operator model of OpenClaw itself, but rather specifically affects the enforcement of access controls within the Feishu integration.

Impact

The failure to enforce per-account disablement policies may allow unauthorized actions within the Feishu environment, potentially leading to unauthorized data access, message manipulation, or unintended API interactions. The extent of the damage is dependent on the specific configuration of the OpenClaw Gateway and the ability of attackers to route malicious or unauthorized input through the affected Feishu tools.

Recommendation

  • Upgrade the OpenClaw @openclaw/feishu package to version 2026.6.9 or later immediately.
  • Disable the affected Feishu feature within the OpenClaw configuration if it is not explicitly required for business operations.
  • Review and restrict channel and tool allowlists for the Gateway to limit the impact of potential unauthorized command execution.
  • Ensure that separate OpenClaw Gateways are used for mutually untrusted user groups to maintain appropriate isolation boundaries.
]]>highadvisoryauthorization-bypasssoftware-vulnerabilitysupply-chain