{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T21:24:34Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nMutating internal ACP chat commands missed the operator.admin gate that should separate read-only and mutating control-plane actions.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: \u003c 2026.3.22\n- Fixed: \u003e= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `229426a257e49694a59fa4e3895861d02a4d767f`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/auto-reply/reply/commands-acp.ts now requires operator.admin for mutating internal ACP actions.\n- src/auto-reply/reply/commands-acp.test.ts ships regression coverage for non-admin denial and admin success cases.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-3w6x-gv34-mqpf",
  "modified": "2026-03-26T21:24:34Z",
  "published": "2026-03-26T21:24:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-3w6x-gv34-mqpf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/229426a257e49694a59fa4e3895861d02a4d767f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw\u0027s mutating internal ACP chat commands missed operator.admin scope enforcement"
}