Incorrect Authorization in ClawHub Application Affects User Privileges

CVE-2026-100604

What is CVE-2026-100604?

ClawHub's application exhibits an incorrect authorization vulnerability where an organization's previously published skill retains the ownerUserId tied to its initial publisher. This flaw allows an authenticated user, who originally published a skill, to reclaim control over that skill — including the ability to transfer, delete, or restore it — despite having their organizational privileges revoked. As a result, the historical trust in the user is exploited, enabling potential unauthorized actions on the skill's management. This security issue was resolved in a patch released on September 11, 2026, and it is crucial for self-hosted deployments to update to this version to mitigate the risk.

References