ClawHub CVE-2026-100603

Requires four distinct ordinary authenticated ClawHub accounts (PR:L - no moderator, admin, or elevated role). Each account files an abuse report against a visible skill; reaching the four-reporter threshold auto-transitions the skill to moderationStatus: hidden with no moderator decision in the loop. The reporter quota counts only reports filed against currently-visible targets, so the same accounts can repeat the hide against additional skills, and official/vendor skills are not exempt. Limiting factors: attacker must be able to create or control multiple authenticated accounts and coordinate them; impact is confined to catalog visibility (hiding), with no data read or code execution. Applies to self-hosted deployments at or before revision cbfee7343ddc that have not updated to 8c2de6c506bb or a later descendant.

Signals conflict between the vendor CVSS and the actual mechanism. The vendor CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) claims HIGH confidentiality, integrity, AND availability impact, but the description supports none of that severity: the flaw lets coordinated accounts flip a skill's moderationStatus to 'hidden'. There is no data disclosure, so VC:H (confidentiality) is unsupported - the impact is availability of catalog content (skills disappear) plus limited integrity (moderation state is tampered without a moderator decision). The tag 'Information Disclosure' compounds this mislabel; this is an interaction-frequency/abuse issue (CWE-799), not a disclosure. On the exploitability side the signals are consistent and favorable to an attacker: network vector, low complexity, and only ordinary authenticated accounts (PR:L, no moderator role). EPSS, KEV, and public POC are all absent from the input, so there is no evidence of active exploitation - treat exploitation status as 'no public exploit identified at time of analysis'. Net: this is a real, easily-reproducible abuse/griefing bug against a niche product, but the 8.7 CVSS overstates true risk because it attributes confidentiality impact that the mechanism does not produce. Priority is MEDIUM (integrity/availability of the catalog), not the CRITICAL that 8.7 implies.

An attacker registers or controls four ordinary ClawHub accounts, then has each account file an abuse report against a target skill; once the fourth report lands, ClawHub automatically sets the skill to hidden with no moderator ever reviewing it. Because the reporter quota only counts reports against still-visible skills, the same four accounts recycle their quota to hide additional skills - including official ones - effectively censoring catalog content at will. No public exploit code is referenced, but the technique requires no special tooling.