OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice…

OpenClaw before version 2026.3.28 contains a privilege escalation vulnerability that allows authenticated operators with write permissions to access admin-level Talk Voice configuration settings. Attackers can exploit the chat.send endpoint to modify sensitive voice configuration settings that should be restricted to administrators only. This vulnerability affects the access control mechanism and allows unauthorized privilege elevation from operator to admin level access.