Home / Vulnerability Intelligence / CVE-2026-28474

CVE-2026-28474 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 5, 2026

OpenClaw Nextcloud Talk - Broken Access Control

Published: March 5, 2026Updated: March 5, 2026Remote Exploitable

Overview

OpenClaw Nextcloud Talk plugin < 2026.2.6 contains a broken access control caused by equality matching on mutable actor.name display name for allowlist validation, letting attackers bypass DM and room allowlists by impersonation, exploit requires attacker to change display name.

Severity & Score

Severity: Critical

CVSS Score: 9.8

Impact

Attackers can bypass allowlists and gain unauthorized access to restricted conversations, compromising confidentiality.

Mitigation

Update to version 2026.2.6 or later.

References

https://www.vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing
https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-28474
Severity: Critical
CVSS Score: 9.8
Type: broken_access_control
Status: new

CWE

CWE-863

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H