https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T19:38:39.481568+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-ghsa-qj22-xqjr-v83v BREW-openclaw-cli-GHSA-qj22-xqjr-v83v — OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection 2026-10-16T19:38:39.502616+00:00

Affected: Homebrew: openclaw-cli

A missing sender-authorization check in Telegram `message_reaction` handling allowed unauthorized users to trigger reaction-derived system events.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Introduced: `2026.2.17` - Affected: `>= 2026.2.17` and `<= 2026.2.24` - Latest published at patch time: `2026.2.24` - Patched in release: `2026.2.25`

## Impact

When reaction notifications are enabled, unauthorized Telegram senders could inject reaction system events despite configured DM/group authorization controls (`dmPolicy`, `allowFrom`, `groupPolicy`, `groupAllowFrom`).

## Fix Commit(s)

- `e56b0cf1a04f992ac6ebc775899f48ea31687640`

## Release Process Note

`patched_versions` is pre-set to the release (`2026.2.25`) so once npm release `2026.2.25` is published, this advisory can be published without further edits.

OpenClaw thanks @tdjackey for reporting.