Description

ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read authorization enforced on normal content access, and up to 8,000 characters of quarantined content may be submitted to the AI provider and reflected in the preview returned to the caller, disclosing restricted skill content. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3682, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:40.187Z",
  "pubdate": "2026-09-26T14:16:40.187Z",
  "executiveSummary": "The ClawHub backend application is affected by a missing authorization vulnerability within the skills:generateChangelogPreview action.\nThis security flaw allows an authenticated user to bypass access control mechanisms and retrieve unauthorized content from skills they do not own or have permission to access.\nBy invoking the publicly accessible changelog preview function, an attacker can force the system to process restricted or quarantined content and return it directly within the preview response.\nThe primary impact is the unauthorized disclosure of sensitive data, as the application fails to validate the requester's permissions against the requested skill resource before initiating the AI processing pipeline.\nThe vulnerability is confirmed in revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 and was resolved in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650.\nSuccessful exploitation requires the attacker to have an active session on the platform but does not require administrative privileges.",
  "technicalDetails": "The vulnerability resides in the backend logic governing the skills:generateChangelogPreview action within the ClawHub application. The root cause is a failure to enforce file-read authorization checks when the function is called, allowing the application to bypass standard security middleware intended to protect private or quarantined skill content.\nUnder normal circumstances, the application restricts access to skill data based on the caller's authorized scope. However, in this specific action, the application fails to verify if the authenticated requester has valid access rights to the specific skill identifier provided in the request payload. Consequently, the backend proceeds to read the previous version of the skill content without verifying the session's authorization status against the resource owner.\nThe attack flow follows a predictable sequence: First, the attacker identifies a target skill ID for which they lack authorized access. Second, the attacker invokes the skills:generateChangelogPreview action by providing the unauthorized skill ID. Third, the backend, lacking the necessary validation, retrieves the protected content associated with that ID. Fourth, the application passes up to 8,000 characters of this retrieved content to the AI provider for processing. Finally, the AI provider's output, which contains the sensitive content, is reflected back to the attacker in the changelog preview interface.\nThis vulnerability is particularly impactful because it allows for the exfiltration of restricted or quarantined data that is otherwise hidden from the user interface. The lack of validation creates a direct oracle for reading non-public data, bypassing the intended security posture of the ClawHub platform. The issue was identified in revision cbfee7343ddc867316dd9b3de6fa8856730f9f41. It is explicitly noted that the npm CLI and OpenClaw runtime remain unaffected, as the flaw is localized to the server-side authorization logic of the ClawHub backend.\nThe remediation, documented in PR #3682 and applied in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, enforces the mandatory authorization check prior to processing the preview request, ensuring that only users with explicit permissions can trigger content generation for a specific skill."
}