Incorrect Authorization Affecting @openclaw/zalouser package, versions <2026.3.12
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-OPENCLAWZALOUSER-15627800
- published15 Mar 2026
- disclosed13 Mar 2026
- creditPeng Zhou
Introduced: 13 Mar 2026
New CVE NOT AVAILABLE CWE-807 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @openclaw/zalouser to version 2026.3.12 or higher.
Overview
@openclaw/zalouser is an OpenClaw Zalo Personal Account plugin via native zca-js integration
Affected versions of this package are vulnerable to Incorrect Authorization in the channels.zalouser.groups. An attacker can gain unauthorized access to restricted channels by reusing a display name that matches an allowlisted group, exploiting the use of mutable group names instead of stable group identifiers for authorization.