OpenClaw Discord moderation authorization used untrusted sender identity
OpenClaw versions up to 2026.2.17 allowed non-admin users to spoof sender identity and execute Discord moderation actions. The vulnerability has been patched in version 2026.2.18 by enforcing trusted sender context instead of untrusted request parameters.
What happened
Discord moderation action handling in OpenClaw versions up to 2026.2.17 used sender identity from request parameters instead of trusted runtime sender context in tool-driven flows.
In setups where Discord moderation actions are enabled and the bot has necessary guild permissions, a non-admin user could request moderation actions (timeout, kick, ban) by spoofing sender identity fields.
Reported impact
Non-admin users could execute moderation actions by spoofing sender identity, potentially enabling privilege escalation in Discord servers using the affected versions.
Index analysis
The vulnerability (CVE-2026-27484) was classified as CWE-862 (Missing Authorization), where the product did not perform authorization checks when actors attempted to perform moderation actions.
The fix enforced trusted sender context (requesterSenderId) instead of untrusted action parameters and added permission checks for required guild capabilities per action.
Governance controls
OpenClaw released patch version 2026.2.18 addressing the vulnerability by enforcing trusted-sender guild permission checks for moderation actions and ignoring untrusted senderUserId parameters.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.