ClawHub CVE-2026-100604

Requires an authenticated ClawHub account that was the ORIGINAL publisher (recorded ownerUserId) of an organization-owned skill; the attacker's current organization privileges may already be revoked or downgraded because the transfer/delete/restore authorization path trusts the historical ownerUserId before checking present org privileges. Exploitation is limited to skills the attacker personally published under an org, so it cannot target arbitrary skills, requires prior legitimate membership, and affects only ClawHub backend deployments at or before revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (clawhub.ai patched 2026-09-11; self-hosted must update). The npm CLI and OpenClaw runtime are not affected.

This is a genuine but moderate-severity issue best treated as a data-integrity/governance flaw rather than a top-tier priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:N/VI:L/VA:L) is internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated account (PR:L) that was the original publisher of an organization skill, and yielding only low integrity and low availability impact with no confidentiality loss. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - so this is 'no public exploit identified at time of analysis.' The impact is bounded to a specific class of records (org-owned skills whose ownerUserId still points at a former/downgraded member), meaning exploitation is targeted and pre-conditioned rather than automatable at scale. Note a data-consistency concern: the source-code diff excerpt provided for the fix commit (8c2de6c…) shows changes to client-IP verification and rate-limiting tests (getVerifiedClientIp, download identity), NOT the ownerUserId/skill-transfer authorization logic described - PR #3680 likely bundles multiple changes, so the shown diff does not by itself corroborate the authorization fix and should be verified against the full PR/advisory. Overall a real bug worth patching but not an emergency.

A developer who published a skill under an organization on ClawHub is later removed from the org or downgraded from an admin/maintainer role. Because the skill still records them as the historical ownerUserId, they invoke the transfer, delete, or restore endpoints and the authorization check honors that stale ownership, letting them seize, remove, or resurrect the org's trusted skill and its history despite no longer holding org privileges. No public exploit code is known; exploitation requires an authenticated account that was the original publisher.