CVE-2026-28474

Опубликовано: 05 мар. 2026

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.

Ссылки

https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r
Patch
Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing
Broken Link
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

Версия до 2026.2.6 (исключая)

EPSS

Процентиль: 39%

0.00489

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-863

Связанные уязвимости

GHSA-r5h9-vjqc-hq3r

github

6 месяцев назад

Nextcloud Talk allowlist bypass via actor.name display name spoofing

BDU:2026-06171