CVE-2026-8629 is an authorization bypass vulnerability in openclaw's crabbox product before version 0.12.0. The flaw allows users who have only shared visibility access to escalate privileges by sending POST requests to the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints. Due to inadequate access control checks, attackers can obtain bridge-agent tickets and impersonate trusted lease-side bridges, effectively bypassing intended permission restrictions. This vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 4.0 score of 8.6, indicating high severity.

Attackers with limited visibility-only access can escalate their privileges to obtain sensitive tickets that allow impersonation of trusted components within the system. This can lead to unauthorized access to code execution environments, WebVNC sessions, and egress agents, potentially compromising system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated and no vendor advisory is provided, users should monitor for updates from the vendor and consider restricting access to the affected endpoints until a fix is available.