An incorrect authorization flaw in OpenClaw allows authenticated attackers with specific privileges to perform unauthorized profile deletions and disrupt browser operations.

The vulnerability exists in the POST /reset-profile endpoint, which fails to correctly validate permissions for authenticated callers who possess operator.write access to browser.request. This allows an attacker to bypass intended privilege boundaries and execute commands to terminate browser processes, close connections, and delete profile directories.

Successful exploitation allows an attacker to cause significant service disruption by stopping browser instances and destroying user profile data. Given the CVSS score of 8.1, this vulnerability poses a high risk to organizational availability and data integrity, as it grants unauthorized control over critical browser-based automation workflows.

Immediate Action: Upgrade the OpenClaw package to version 2026.3.24 or later to apply the necessary authorization checks.

Proactive Monitoring: Review application logs for unusual activity targeting the POST /reset-profile endpoint, specifically monitoring for requests originating from accounts with operator.write privileges that attempt to trigger unauthorized profile resets.

Compensating Controls: Implement strict access control lists or API gateway policies to restrict access to the /reset-profile endpoint to only authorized service accounts while the patch is being deployed.

Public Exploit Available: Unknown

The risk associated with this authorization bypass is substantial due to its potential for total service disruption within the OpenClaw environment. Administrators are urged to prioritize the update to version 2026.3.24 immediately to remediate the underlying logic error and prevent unauthorized profile manipulation.