CVE-2026-62187
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in the npm package @openclaw/feishu (versions up to 2026.6.6) allows ignoring per-account disablement. A lower-trust caller or a configured input path can perform actions requiring stronger authorization, leading to unauthorized operations. The issue is fixed in version 2026.6.9.
Risk Assessment
The risk involves potential unauthorized operations by a lower-trust entity, which could compromise data integrity or allow uncontrolled access to system features.
Recommendation
Immediately update the @openclaw/feishu package to version 2026.6.9 or later, and review input path configurations to limit trust levels.
Other vulnerabilities in @openclaw/feishu
See all- CVE-2026-100540Medium
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
- CVE-2026-62188High
In the OpenClaw @openclaw/feishu library versions up to and including 2026.6.6, an incorrect authorization vulnerability was found where Feishu permission tools could ignore per-account disablement settings. This allows a lower-trust caller or configured input path to perform actions that should require stronger authorization. The issue is fixed in version 2026.6.9.
Original NVD description (English source)
OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue is fixed in version 2026.6.9. Impact depends on the operator's configuration and whether lower-trust input can reach the affected feature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS