CVE-2026-32231 - Vulnerability Analysis

Overview

ZeptoClaw < 0.7.6 contains a broken access control vulnerability caused by trusting caller-supplied identity fields in the generic webhook channel, letting attackers spoof sender and chat_id to bypass authorization, exploit requires access to POST /webhook endpoint.

Severity & Score

Impact

Attackers can spoof messages and abuse session/chat routing, potentially impersonating users and accessing unauthorized chats.

Mitigation

Update to version 0.7.6 or later.

References

• https://github.com/qhkm/zeptoclaw/releases/tag/v0.7.6
• https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-46q5-g3j9-wx5c
• https://github.com/qhkm/zeptoclaw/commit/bf004a20d3687a0c1a9e052ec79536e30d6de134
• https://github.com/qhkm/zeptoclaw/pull/324

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🟠 CVE-2026-32231 - High (8.2) ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32231/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner