OpenClaw before version 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons. The vulnerability fails to properly enforce configured approver identity, allowing non-approver users to click approval buttons and resolve pending execution or plugin approval requests without proper authorization. This represents a significant security flaw that could allow unauthorized access to critical approval workflows within the OpenClaw platform.