CVE-2026-62187 Overview
CVE-2026-62187 is an authorization bypass vulnerability in the OpenClaw Feishu tools npm package @openclaw/feishu. Versions at or below 2026.6.6 fail to honor per-account disablement, allowing lower-trust callers or configured input paths to perform actions that should require stronger authorization checks. The flaw is categorized as [CWE-863] Incorrect Authorization. Exploitation can result in unauthorized operations against the Feishu integration. The maintainers fixed the issue in version 2026.6.9.
Critical Impact
A lower-trust caller can bypass per-account disablement controls to execute privileged Feishu operations, with impact scoped to the operator's configuration and whether untrusted input reaches the affected feature.
Affected Products
- @openclaw/feishu npm package versions <= 2026.6.6
- OpenClaw Feishu tools running on Node.js
- Applications integrating the OpenClaw Feishu module for Lark/Feishu automation
Discovery Timeline
- 2026-07-13 - CVE-2026-62187 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-62187
Vulnerability Analysis
The OpenClaw Feishu tools package exposes functionality for interacting with the Feishu (Lark) collaboration platform. Operators can disable specific accounts or scoped capabilities to restrict what callers can perform. The vulnerability stems from the package failing to consistently enforce those per-account disablement flags before executing sensitive actions.
Because the authorization check is missed on affected code paths, a caller with lower privileges can invoke operations reserved for higher-trust identities. The confidentiality and integrity impact is high, as attackers can read or modify Feishu resources that should be gated. Availability is not directly affected according to the CVSS v4 vector.
Root Cause
The root cause is incorrect authorization logic [CWE-863]. The affected code paths do not verify that the requesting account or input source satisfies the operator-configured disablement policy before dispatching Feishu API actions. Authorization decisions rely on partial context, permitting requests that should be rejected.
Attack Vector
Exploitation occurs over the network with low attacker complexity and requires low privileges. An attacker who can reach an input path consumed by the vulnerable tool — for example a webhook, message handler, or upstream automation input — can trigger actions that should have required a stronger authorization check. No user interaction is required. Actual impact depends on how the operator has wired inputs into the affected feature.
No public proof-of-concept exploit or CISA KEV listing exists for this issue at the time of publication. The EPSS score is 0.213%, indicating low near-term exploitation probability.
See the GitHub Security Advisory GHSA-2q7j-2vhx-56g8 and the VulnCheck Advisory for maintainer-provided technical detail.
Detection Methods for CVE-2026-62187
Indicators of Compromise
- Feishu API calls originating from accounts or scopes that operators had explicitly disabled in configuration.
- Unexpected Feishu message send, file access, or bot administrative actions initiated from lower-trust input paths.
- Log entries showing successful tool invocations from callers that previously received authorization denials.
Detection Strategies
- Inventory Node.js projects and container images for @openclaw/feishu and flag any version at or below 2026.6.6 using Software Composition Analysis or npm ls @openclaw/feishu.
- Correlate application logs with Feishu audit logs to detect actions performed on behalf of disabled accounts.
- Alert on invocations of privileged Feishu tool functions where the calling identity does not match the operator's allow-list.
Monitoring Recommendations
- Enable verbose logging of authorization decisions inside the OpenClaw integration and forward to a centralized SIEM.
- Monitor Feishu tenant audit trails for anomalous automation activity, particularly bulk read or write operations.
- Track outbound network calls from Node.js hosts to Feishu API endpoints and baseline expected volume per account.
How to Mitigate CVE-2026-62187
Immediate Actions Required
- Upgrade @openclaw/feishu to version 2026.6.9 or later across all deployments.
- Audit operator configuration to identify accounts and scopes that were expected to be disabled and confirm they are now enforced.
- Review Feishu audit logs from the disclosure window forward for unauthorized operations tied to lower-trust callers.
Patch Information
The maintainers fixed the authorization bypass in @openclaw/feishu version 2026.6.9. Refer to the GitHub Security Advisory GHSA-2q7j-2vhx-56g8 for the official fix and upgrade guidance.
Workarounds
- Restrict which input paths can reach the OpenClaw Feishu tool to trusted, authenticated callers only.
- Enforce authorization at an upstream gateway or middleware layer so disabled accounts cannot invoke Feishu actions even if the library check is missed.
- Rotate Feishu bot tokens and application secrets after upgrading to invalidate any credentials that may have been exercised through the bypass.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
