OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. No…

OpenClaw before version 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons. The vulnerability fails to properly enforce configured approver identity, allowing non-approver users to click approval buttons and resolve pending execution or plugin approval requests without proper authorization. This represents a significant security flaw that could allow unauthorized access to critical approval workflows within the OpenClaw platform.