Listen to this Post
The vulnerability stems from a logic flaw in Nextcloud Talk’s room authorization flow within the openclaw npm package. Instead of relying on the immutable roomToken—a stable, unique identifier for a conversation—the system matched authorization policies against the human-readable room name (displayName). Room names are user‑defined, can be changed, and are not guaranteed to be unique across the application. This allowed an attacker to create a new room with a name identical to an existing, policy‑protected room. When the authorization lookup occurred, the system collided on the display name, erroneously applying the victim room’s allow‑list policy to the attacker’s room. As a result, a user who was authorized to access the original room could inadvertently (or intentionally) gain access to the second, similarly named room without proper permission checks. The flaw existed because the code in `extensions/nextcloud-talk/src/inbound.ts` and `policy.ts` originally resolved and keyed room authorization on the mutable display name rather than the stable room token. The fix, introduced in version 2026.3.22, refactors both files to use the `roomToken` as the authoritative identifier. Specifically, inbound message handling now resolves allow‑list policies by looking up the room via its token, and policy enforcement caches and matches decisions against the token instead of the name. This change eliminates the name‑based collision vector, ensuring that each room’s authorization state remains correctly isolated even if display names are duplicated.
Platform: Nextcloud Talk
Version: < 2026.3.22
Vulnerability : Authorization bypass via
Severity: Medium
date: 2026-03-26
Prediction: Already patched
Analytics under What Undercode Say:
Verify current installed version npm list openclaw Check if vulnerable version range npm view openclaw versions | grep -E "2026.3.(1[0-9]|2[0-1])" Confirm fix applied by inspecting commit git show a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66 Validate token-based policy in inbound.ts grep -A5 "roomToken" extensions/nextcloud-talk/src/inbound.ts
Exploit:
- Identify an existing room with restrictive authorization policies (e.g., allowlist).
- Create a new room with an identical display name.
- As a user authorized in the original room, join the new room.
- The server mistakenly applies the original room’s policy, granting access to the attacker’s room.
Protection from this CVE
- Upgrade openclaw to version `2026.3.22` or later.
- If immediate upgrade is not possible, manually enforce unique room names and monitor for name collisions.
- After patching, regenerate room tokens for existing rooms to invalidate any stale name‑based mappings.
Impact
- Unauthorized access to private rooms.
- Potential data exposure or cross‑room eavesdropping.
- Undermining of allow‑list and access control policies.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
