medium6.8
CVE-2026-100540
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations.
Impact
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
Affected products
| Product | Affected versions |
|---|---|
| OpenClaw Feishu | before 2026.8.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.