Description

ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-26T14:16:40.330Z",
  "pubdate": "2026-09-26T14:16:40.330Z",
  "executiveSummary": "The ClawHub backend application is susceptible to an automated denial-of-service and content suppression vulnerability within the skill report moderation flow. This flaw allows a small group of authenticated, unprivileged users to bypass formal moderation workflows and force the system to automatically flag and hide skills from the public catalog.\nThe vulnerability resides in the automated logic that triggers a 'hidden' moderation status once a specific reporting threshold (four reports) is reached. Because the system fails to adequately account for reporter history or distinguish between malicious and legitimate flags, an attacker can persistently suppress arbitrary content, including official platform skills. This effectively allows an adversary to disrupt service availability and perform reputation sabotage without any human moderator oversight. The risk is high for platforms relying on public contributions, as it grants ordinary users undue influence over platform visibility and integrity. The issue was resolved in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, and all self-hosted deployments are advised to upgrade immediately to remediate the logic flaw.",
  "technicalDetails": "The vulnerability originates from a flawed automated moderation logic within the ClawHub backend's report processing subsystem. Specifically, the system employs an unsupervised threshold-based mechanism where a target skill is automatically transitioned to 'moderationStatus: hidden' upon receiving reports from four distinct authenticated accounts. This architectural decision treats the report count as an objective indicator of policy violation rather than an input for human review.\nExploitation is trivial for any authenticated user. An attacker with control over four ordinary accounts can programmatically or manually report a target skill. Upon the fourth report, the backend state machine updates the skill's moderationStatus attribute to 'hidden', immediately removing it from the public catalog. Because the application logic resets or ignores reporter quotas once a target is no longer visible, these accounts can cycle through multiple targets, essentially weaponizing the reporting mechanism to scrub legitimate content or official skills from the platform.\nThe vulnerable component is the skill report moderation flow, which fails to implement rate limiting, reputation scoring for reporters, or administrative verification before the status transition occurs. At revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, the system did not distinguish between standard and official skills, nor did it implement a cooldown or validation period for accounts filing reports. The lack of secondary verification or an 'appeal' phase meant that once the threshold of four reports was reached, the hidden state was enforced by the database layer without oversight.\nThe attack flow follows these steps: 1) The attacker selects a target skill. 2) Four distinct authenticated accounts submit a report against the target. 3) The backend increments the report count and triggers a validation check. 4) The threshold check returns true, invoking the moderation update function. 5) The database commits the 'hidden' status to the skill object. 6) The skill is excluded from the catalog API responses. Because the reporter quota logic only counts reports against currently visible targets, an attacker can repeat this cycle indefinitely, creating a persistent, automated censorship vector that requires manual intervention from a platform administrator to reverse."
}