CVE-2026-28474 | OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 … | CVSS 9.8 CRITICAL

Description

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized access to restricted conversations.

Metadata

CVE ID: CVE-2026-28474
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-27 19:19 UTC
Published: 2026-03-05 21:59 UTC
Last updated: 2026-03-09 18:08 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: OpenClaw / nextcloud-talk
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
OpenClaw	nextcloud-talk	—	0 < 2026.2.6

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	Incorrect Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

GitHub Security Advisory (GHSA-r5h9-vjqc-hq3r) https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r
Patch Commit #1 https://github.com/openclaw/openclaw/commit/6b4b6049b47c3329a7014509594647826669892d
VulnCheck Advisory: OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing https://www.vulncheck.com/advisories/openclaw-nextcloud-talk-allowlist-bypass-via-actorname-display-name-spoofing