{"schema":"threatline.record/2","record":{"id":"CVE-2026-100603","aliases":["GHSA-5jj4-m8c9-gwcq"],"summary":"ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports","details":"ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.","categories":["Unclassified"],"product":"clawhub","vendor":"openclaw","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100603","source_modified_at":"2026-09-28T17:05:43.542Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"clawhub","vendor":"openclaw","versions":[{"version":"0","status":"affected","versionType":"git","lessThan":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650"},{"version":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","status":"unaffected","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100603","source_modified_at":"2026-09-28T17:05:43.542Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"clawhub","ecosystem":null},"version":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00294,"percentile":0.2085,"score_date":"2026-10-23"},"published_at":"2026-09-26T13:22:47.730Z","modified_at":"2026-09-28T17:05:43.542Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100603","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-28T17:05:43.542Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100603","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/openclaw/clawhub/security/advisories/GHSA-5jj4-m8c9-gwcq","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/clawhub-before-8c2de6c506-skill-hiding-via-coordinated-reports","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-28T17:05:07.198454Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T17:05:43.542Z","content_hash":"d709dfaf8a227163b7226ee6a8c95fcea1226a65c8546a0209577c8d6f47eae4"}}