OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send

Fixed in OpenClaw 2026.3.24, the current shipping release.

Summary

The shared /allowlist command persists channel authorization config through writeConfigFile(...) but does not re-validate gateway client scopes for internal gateway callers. Because chat.send is intentionally reachable to operator.write callers and still creates a generic command-authorized internal context, an authenticated write-scoped gateway client can indirectly mutate channel allowFrom and groupAllowFrom policy that direct config.patch correctly reserves to operator.admin.

This is not just a generic code smell. The current code already shows the intended boundary by adding sink-side internal admin checks to shared /config and /plugins writes, but /allowlist was left behind.

Details

The gateway's documented scope split is clear:

• chat.send is a write-scoped action.
• direct config mutation is an admin-scoped action.

The vulnerable path is:

1. A gateway client authenticates with operator.write.
2. The client calls chat.send, which is intentionally allowed for that scope.
3. chat.send builds an internal message context with CommandAuthorized: true and carries GatewayClientScopes into the reply pipeline.
4. resolveCommandAuthorization(...) converts that internal message into isAuthorizedSender=true in the common case where no stricter commands.allowFrom override is configured.
5. /allowlist add|remove accepts that generic command authorization and proceeds into its config-backed edit path.
6. The handler clones the parsed config, calls plugin.allowlist.applyConfigEdit(...), validates the result, and persists it with writeConfigFile(validated.config).
7. No sink-side check requires operator.admin before the persistent write occurs.

That creates a direct control-plane mismatch:

• config.patch rejects the same caller with missing scope: operator.admin.
• /allowlist add dm ... or /allowlist add group ... reached through chat.send can still rewrite channel authorization state.