| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.25 | 2026.3.25 |
| openclaw | < 2026.3.28 | 2026.3.28 |
MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback
openclaw<= 2026.3.242026.3.252026.3.24Microsoft Teams feedback invokes previously bypassed sender authorization and could record feedback or trigger reflection for unauthorized senders. Commit c5415a474bb085404c20f8b312e436997977b1ea applies the same DM and group authorization checks to feedback invokes.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit c5415a474bb085404c20f8b312e436997977b1ea.
c5415a474bb085404c20f8b312e436997977b1eaRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free