The vulnerability in openclaw crabbox before version 0.12.0 arises from improper authorization checks (CWE-639) on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints. Users with shared visibility-only access can send POST requests to these endpoints to retrieve bridge-agent tickets, which should be restricted. This flaw permits privilege escalation by allowing unauthorized users to impersonate trusted components within the system.

Exploitation of this vulnerability allows attackers with limited visibility permissions to escalate their privileges and obtain sensitive bridge-agent tickets. This can lead to unauthorized impersonation of trusted lease-side bridges, potentially compromising system integrity and confidentiality. The CVSS 4.0 base score is 8.6, indicating a high impact with network attack vector, low attack complexity, no privileges required beyond visibility, and no user interaction needed.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisories for updates and consider restricting access to the affected endpoints as a temporary measure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.