Threats tagged 'ghsa-7q3h-63x4-wqwg'

CVE-2026-100604 is an incorrect authorization vulnerability in the ClawHub backend where organization-owned skills retain the original publisher's user ID. This flaw allows an authenticated user who originally published a skill to transfer, delete, or restore it even after losing organization privileges. The vulnerability was fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, deployed on 2026-09-11. Self-hosted deployments should update to this revision or later. The npm CLI and OpenClaw runtime are not affected.