CVE-2026-28474
CVE-2026-28474 · OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.
CVSS 9.3 · Critique · EPSS 0,6% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
nextcloud-talk
- Versions du logiciel
- ≥ 0, < 2026.2.6: Concernée (custom)
Mettez à jour vers 2026.2.6
@openclaw/nextcloud-talk npm
- Plages de versions concernées
- SEMVER: < 2026.2.6
Mettez à jour vers 2026.2.6
Sources originales
- https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r
- https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
- https://www.vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing
- https://nvd.nist.gov/vuln/detail/CVE-2026-28474