An improper access control vulnerability in OpenClaw allows authenticated callers to bypass security restrictions and expose internal page content.

This flaw involves a missing authorization vulnerability tied to CWE-862, specifically failing to validate browser targets after navigation in screenshot and snapshot routes. The attacker requires low-level privileges (authenticated caller).

A successful exploit permits authenticated users to bypass server side request forgery restrictions, potentially exposing sensitive internal page content or disallowed resources. While the CVSS score is 7.7, which indicates high severity, the exposure of internal architecture poses significant risks to organizational confidentiality and internal network visibility.

Immediate Action: Update the OpenClaw package to version 2026.4.14 or later using npm to resolve the missing authorization flaw.

Proactive Monitoring: Review application access logs for unusual requests targeting browser snapshot, screenshot, and tab routes from standard user accounts.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the reach of potential server side request forgery attacks if internal services are targeted.

Public Exploit Available: No — no confirmed public exploit or weaponized module is currently cataloged in the available enrichment data.

Given the high severity score and the potential for unauthorized internal data exposure, administrators must treat this issue with urgency. Apply the official update to version 2026.4.14 immediately to ensure proper authorization checks are enforced across all navigation and snapshot routes.