CVE-2026-100583

OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata from servers or channels outside the operator's allowlist.

Score

CVSS 4.0 5.3 Medium

Status

Deferred - disclosure@vulncheck.com

Published

2026-09-26

Last modified

2026-10-08

Weaknesses

CWE-862

Affected products

• Discord (Openclaw)

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-35wj-hm2r-ghgw
• https://www.vulncheck.com/advisories/openclaw-discord-before-2026.7.1-authorization-bypass