CVE-2026-8621 is an authentication bypass vulnerability in openclaw's Crabbox prior to version 0.12.0. It allows attackers authenticated with a shared token but lacking admin privileges to impersonate other owners or organizations by spoofing the X-Crabbox-Owner and X-Crabbox-Org HTTP headers. This spoofing bypasses authorization checks, granting unauthorized access to owner- or organization-scoped lease operations. The vulnerability is due to improper authentication controls (CWE-287). The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor, and the product is not a cloud service.

Successful exploitation allows an attacker with a shared token but no admin rights to impersonate other users or organizations by injecting spoofed identity headers. This leads to unauthorized access to lease operations scoped to victim accounts, potentially exposing sensitive data or allowing unauthorized actions within those accounts. The vulnerability impacts confidentiality, integrity, and availability of the affected system's resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the use of shared tokens to trusted parties only and monitor for anomalous use of identity headers if possible. Avoid exposing shared tokens in untrusted environments. Follow vendor communications closely for updates on patches or official mitigations.