---
title: "OpenClaw API Authorization Flaw Allows Canceling Others' Reservations"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Aug/10/openclaw/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_112f0e07b971dc3bd92c428b"
published: "2026-08-10T02:05:16.000Z"
score: 70
channel: "ai"
tags: ["API Security","OpenClaw","Authorization Vulnerability"]
---

# OpenClaw API Authorization Flaw Allows Canceling Others' Reservations

## AI commentary

> This is not a theoretical vulnerability—it was hand-verified by the author. For any team using OpenClaw to manage reservations, I recommend revoking API access immediately and waiting for an official fix, while also checking for abnormal cancellation records.

## At a glance

OpenClaw has been found to have a serious API authorization flaw. Simon Willison disclosed on his blog that the API performs zero authorization checks when canceling other people's reservations. He actually tested this against the user in waitlist position #1, and the cancellation went through. The issue means any caller who knows the request format could manipulate user data, affecting users who rely on this AI assistant for scheduling management. It needs to be fixed immediately.

## Key points

- OpenClaw's API lacks authorization checks for canceling reservations.
- The author tested it against the user in waitlist position #1 and the cancellation actually went through.
- The flaw could allow unauthorized actors to manipulate user scheduling data.
- Developers are advised to add permission validation to the API and prompt users to update.

## Full text

The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've …

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_112f0e07b971dc3bd92c428b