Description

ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current organization privileges. An authenticated user who originally published an organization skill can therefore transfer, delete, or restore that skill — taking control of its trusted name and history — even after their organization privileges have been revoked or downgraded. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3680, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-26T14:16:40.473Z",
  "pubdate": "2026-09-26T14:16:40.473Z",
  "executiveSummary": "ClawHub is susceptible to an improper authorization vulnerability where organization-owned skills incorrectly retain the original publisher's 'ownerUserId'. This flaw allows a previously authorized user—even after their organizational privileges have been revoked or downgraded—to perform unauthorized lifecycle management operations on skills they no longer rightfully control.\nThe vulnerability resides within the ClawHub backend logic, which prioritizes the historical 'ownerUserId' over current organization-level access control checks. An attacker can manipulate, transfer, delete, or restore organization-owned skills, effectively hijacking the reputation, naming, and historical data associated with those assets.\nThis represents a significant integrity and availability risk for organization-managed repositories. Exploitation requires the attacker to be an authenticated user who previously held publishing rights to a specific skill within the affected organization. The issue affects ClawHub deployments prior to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650. Successful exploitation grants attackers unauthorized administrative control over organization assets without requiring active, valid permissions at the time of the action.",
  "technicalDetails": "The root cause of this vulnerability is a design flaw in the authorization middleware and skill management logic of the ClawHub backend. When a skill is published under an organization, the system erroneously associates it with the individual 'ownerUserId' of the creator rather than strictly binding it to the organization's resource identifier in the access control matrix.\nDuring lifecycle operations—such as skill transfers, deletions, or restorations—the backend implementation relies on a faulty check that verifies the 'ownerUserId' against the authenticated user's session. Because the application logic trusts the historical publisher as a privileged entity, it fails to evaluate whether the current user still possesses the necessary organizational roles or group memberships to perform such sensitive tasks.\nThe attack flow follows a predictable pattern: First, an attacker who previously possessed publishing rights to an organization skill ensures their account remains authenticated within the platform. Even after an administrator has removed the attacker's organizational access or downgraded their account privileges, the backend continues to resolve the attacker’s 'ownerUserId' as the authoritative owner of the targeted skill object. The attacker then submits a request to the API for a prohibited operation, such as a skill deletion or an ownership transfer. The backend, seeing the match between the requester's ID and the hardcoded 'ownerUserId' stored with the skill, grants the request, bypassing contemporary authorization guards.\nThis vulnerability is particularly severe because it allows for 'name-squatting' or hijacking of trusted organizational assets. By deleting or restoring a skill, an attacker can manipulate the public-facing history and metadata of a skill, potentially leading to supply chain confusion or the injection of malicious code into a previously trusted identifier.\nThe issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41. The fix, implemented in PR #3680, modifies the authorization flow to explicitly validate current organizational permissions against the repository's ownership metadata, ensuring that the 'ownerUserId' historical reference is no longer treated as a privileged authorization credential. This change was integrated in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650."
}