{"id":"CVE-2026-100603","summary":"ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports","details":"ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.","aliases":["GHSA-5jj4-m8c9-gwcq"],"modified":"2026-09-30T03:30:49.459692705Z","published":"2026-09-26T13:22:47.730Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-799"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100603.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100603.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/clawhub/security/advisories/GHSA-5jj4-m8c9-gwcq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100603"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/clawhub-before-8c2de6c506-skill-hiding-via-coordinated-reports"},{"type":"FIX","url":"https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openclaw/clawhub","events":[{"introduced":"0"},{"fixed":"8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650"}],"database_specific":{"source":"REFERENCES"}}],"versions":["prod/v2026.09.09.1","deploy/prod/20260909-052907Z-494c348","prod/v2026.09.04.1","deploy/prod/20260904-232140Z-ba5eb72","prod/v2026.09.02.2","deploy/prod/20260902-114415Z-d405470","prod/v2026.09.02.1","deploy/prod/20260902-002915Z-251ef76","prod/v2026.08.31.2","deploy/prod/20260831-175044Z-e2a82b3","prod/v2026.08.31.1","deploy/prod/20260831-042114Z-1643653","prod/v2026.08.27.1","deploy/prod/20260827-205813Z-efc565c","prod/v2026.08.19.2","deploy/prod/20260819-065811Z-bfb760d","prod/v2026.08.19.1","deploy/prod/20260819-052709Z-d6ed957","v0.23.3","v0.23.2","prod/v2026.08.02.1","deploy/prod/20260802-053000Z-3d3ac29","prod/v2026.07.30.1","deploy/prod/20260730-174302Z-70ce492","prod/v2026.07.26.2","deploy/prod/20260726-194300Z-c918f9f","prod/v2026.07.26.1","deploy/prod/20260726-174207Z-010c87f","prod/v2026.07.24.2","deploy/prod/20260724-233949Z-fd61062","prod/v2026.07.24.1","deploy/prod/20260724-203241Z-ead9d94","prod/v2026.07.08.1","deploy/prod/20260708-034250Z-6d27f3c","prod/v2026.07.23.1","deploy/prod/20260723-181221Z-eb3050f","prod/v2026.07.22.2","deploy/prod/20260722-050654Z-eb47a7c","prod/v2026.07.22.1","deploy/prod/20260722-033423Z-7ef2b15","prod/v2026.07.21.3","deploy/prod/20260721-054036Z-723f155","prod/v2026.07.21.2","deploy/prod/20260721-041248Z-8a8e692","prod/v2026.07.21.1","deploy/prod/20260721-023642Z-a68f707","prod/v2026.07.20.2","deploy/prod/20260720-230649Z-3097319","prod/v2026.07.20.1","deploy/prod/20260720-072327Z-ed9c8fd","prod/v2026.07.18.2","deploy/prod/20260718-015627Z-db3b3fe","prod/v2026.07.18.1","deploy/prod/20260718-011339Z-af3d01c","prod/v2026.07.17.3","deploy/prod/20260717-185753Z-8142b35","prod/v2026.07.17.2","deploy/prod/20260717-003550Z-43e44a8","prod/v2026.07.17.1","deploy/prod/20260717-001110Z-97905c8","prod/v2026.07.16.1","deploy/prod/20260716-184139Z-b23d10d","prod/v2026.07.10.1","deploy/prod/20260710-022008Z-2191194","prod/v2026.07.09.2","deploy/prod/20260709-180850Z-de29369","prod/v2026.07.09.1","deploy/prod/20260709-035640Z-dfca6f5","prod/v2026.07.07.1","deploy/prod/20260707-004945Z-fe7aab3","prod/v2026.07.07.2","deploy/prod/20260707-234719Z-725af4e","prod/v2026.07.06.5","deploy/prod/20260706-205827Z-07e542f","prod/v2026.07.06.4","deploy/prod/20260706-173036Z-de19a6b","prod/v2026.07.06.3","deploy/prod/20260706-172312Z-1166a37","prod/v2026.07.06.2","deploy/prod/20260706-170529Z-2651570","prod/v2026.07.06.1","deploy/prod/20260706-113033Z-77c6671","prod/v2026.07.03.2","deploy/prod/20260703-112333Z-9ff6fce","prod/v2026.07.03.1","deploy/prod/20260703-041442Z-3ce0ce4","prod/v2026.07.02.1","deploy/prod/20260702-151139Z-a89bfaf","prod/v2026.06.30.3","deploy/prod/20260630-052036Z-919f047","prod/v2026.06.30.2","deploy/prod/20260630-024808Z-ab8e3b1","v0.23.1","prod/v2026.06.30.1","deploy/prod/20260630-021601Z-a230d96","prod/v2026.06.29.1","deploy/prod/20260629-234306Z-aa5952e","prod/v2026.06.27.4","deploy/prod/20260627-160402Z-bdb23c3","prod/v2026.06.27.3","deploy/prod/20260627-143554Z-18dac69","prod/v2026.06.27.2","deploy/prod/20260627-142305Z-67b7403","prod/v2026.06.27.1","deploy/prod/20260627-003357Z-447a5b0","prod/v2026.06.26.2","deploy/prod/20260626-231028Z-ce5455b","prod/v2026.06.26.1","deploy/prod/20260626-085018Z-a954bef","prod/v2026.06.25.7","deploy/prod/20260625-081134Z-8e56a9f","prod/v2026.06.25.6","deploy/prod/20260625-074836Z-164959d","prod/v2026.06.25.5","deploy/prod/20260625-063545Z-b5d1371","prod/v2026.06.25.4","deploy/prod/20260625-052841Z-843cf78","prod/v2026.06.25.3","deploy/prod/20260625-050530Z-d1716c6","prod/v2026.06.25.2","deploy/prod/20260625-045900Z-8e7c8d4","prod/v2026.06.25.1","deploy/prod/20260625-043053Z-e337136","prod/v2026.06.24.5","deploy/prod/20260624-130548Z-fa222d4","prod/v2026.06.24.4","deploy/prod/20260624-065233Z-2bf8113","prod/v2026.06.24.3","deploy/prod/20260624-042809Z-d3fa80c","prod/v2026.06.24.2","deploy/prod/20260624-020611Z-35f6d34","prod/v2026.06.24.1","deploy/prod/20260624-005758Z-32aa234","prod/v2026.06.23.7","deploy/prod/20260623-221214Z-cc3fc61","v0.23.0","prod/v2026.06.23.6","prod/v2026.06.23.5","deploy/prod/20260623-183838Z-9b352d7","deploy/prod/20260623-095920Z-9b352d7","prod/v2026.06.23.4","deploy/prod/20260623-090710Z-6aab4f9","prod/v2026.06.23.3","deploy/prod/20260623-083226Z-94f2f53","prod/v2026.06.23.2","deploy/prod/20260623-053803Z-4a78ca3","prod/v2026.06.23.1","deploy/prod/20260623-044751Z-917fb3f","prod/v2026.06.22.3","deploy/prod/20260622-071034Z-39d03a5","prod/v2026.06.22.2","deploy/prod/20260622-043054Z-379c187","prod/v2026.06.22.1","deploy/prod/20260622-005610Z-a86c48c","prod/v2026.06.20.3","deploy/prod/20260620-025932Z-6f28659","prod/v2026.06.20.2","deploy/prod/20260620-023700Z-3836b76","prod/v2026.06.20.1","deploy/prod/20260620-003154Z-ea0125d","prod/v2026.06.19.3","deploy/prod/20260619-220702Z-0f5496f","prod/v2026.06.19.2","deploy/prod/20260619-204507Z-7accfb7","prod/v2026.06.19.1","deploy/prod/20260619-022924Z-1cac1b2","prod/v2026.06.18.2","deploy/prod/20260618-010039Z-4bc58e4","prod/v2026.06.18.1","deploy/prod/20260618-003024Z-2d93401","prod/v2026.06.17.3","deploy/prod/20260617-223349Z-11ad31a","prod/v2026.06.17.2","deploy/prod/20260617-004422Z-4860945","prod/v2026.06.17.1","deploy/prod/20260617-000550Z-1e7de4a","prod/v2026.06.16.9","deploy/prod/20260616-153434Z-0e20d64","prod/v2026.06.16.8","deploy/prod/20260616-150722Z-303075c","prod/v2026.06.16.7","deploy/prod/20260616-030716Z-1b66b84","prod/v2026.06.16.6","deploy/prod/20260616-030357Z-9115151","v0.22.0","prod/v2026.06.16.5","deploy/prod/20260616-012408Z-69dd3b5","prod/v2026.06.16.4","deploy/prod/20260616-011128Z-44f4ab0","prod/v2026.06.16.3","deploy/prod/20260616-005639Z-f366269","prod/v2026.06.16.2","deploy/prod/20260616-003912Z-76638de","prod/v2026.06.16.1","deploy/prod/20260616-003524Z-89bb8fe","prod/v2026.06.15.6","deploy/prod/20260615-180858Z-44ce895","prod/v2026.06.15.5","deploy/prod/20260615-163736Z-bb35aca","prod/v2026.06.15.4","deploy/prod/20260615-163058Z-078425f","prod/v2026.06.15.3","deploy/prod/20260615-061547Z-078d1c8","prod/v2026.06.15.2","deploy/prod/20260615-034504Z-2293016","prod/v2026.06.15.1","deploy/prod/20260615-015847Z-03f9734","prod/v2026.06.14.3","deploy/prod/20260614-234854Z-b8ec008","prod/v2026.06.14.2","deploy/prod/20260614-230744Z-fdb4d31","prod/v2026.06.14.1","deploy/prod/20260614-203106Z-9ef3372","prod/v2026.06.13.3","deploy/prod/20260613-224114Z-6afb91b","prod/v2026.06.13.2","deploy/prod/20260613-213911Z-749028d","prod/v2026.06.13.1","deploy/prod/20260613-213144Z-6820029","prod/v2026.06.12.2","deploy/prod/20260612-233433Z-4b3c2bb","v0.21.0","prod/v2026.06.12.1","deploy/prod/20260612-001558Z-a1becd0","prod/v2026.06.11.1","deploy/prod/20260611-174907Z-2c9aa36","v0.20.2","prod/v2026.06.10.2","deploy/prod/20260610-041125Z-e9571f3","prod/v2026.06.10.1","deploy/prod/20260610-035941Z-0724abc","prod/v2026.06.09.3","deploy/prod/20260609-222245Z-741599d","prod/v2026.06.09.2","deploy/prod/20260609-043208Z-89a89af","prod/v2026.06.09.1","deploy/prod/20260609-024445Z-be70ae5","prod/v2026.06.08.2","deploy/prod/20260608-055419Z-1fa4f90","prod/v2026.06.08.1","deploy/prod/20260608-033043Z-5c19da4","v0.20.0","prod/v2026.06.06.6","deploy/prod/20260606-235826Z-8e1bad4","prod/v2026.06.06.5","deploy/prod/20260606-230930Z-999131e","prod/v2026.06.06.4","deploy/prod/20260606-215647Z-3ead985","prod/v2026.06.06.3","deploy/prod/20260606-212428Z-9ce5e70","prod/v2026.06.06.2","deploy/prod/20260606-003339Z-d2525b1","prod/v2026.06.06.1","deploy/prod/20260606-001730Z-8ebae39","v0.19.2","prod/v2026.06.05.7","deploy/prod/20260605-215502Z-94ded18","prod/v2026.06.05.6","deploy/prod/20260605-040520Z-2d719fe","prod/v2026.06.05.5","deploy/prod/20260605-032359Z-1a968d8","v0.19.1","prod/v2026.06.05.4","deploy/prod/20260605-021742Z-fe4acc8","prod/v2026.06.05.3","deploy/prod/20260605-015059Z-1c8543a","prod/v2026.06.05.2","deploy/prod/20260605-014234Z-7cd0ef3","prod/v2026.06.05.1","deploy/prod/20260605-012338Z-9cf9e12","prod/v2026.06.04.1","deploy/prod/20260604-231317Z-3fbe275","v0.19.0","prod/v2026.06.03.3","deploy/prod/20260603-214852Z-162528a","prod/v2026.05.30.1","deploy/prod/20260530-053946Z-9a20795","prod/v2026.06.03.2","deploy/prod/20260603-072634Z-953358a","prod/v2026.06.03.1","deploy/prod/20260603-052159Z-0a79612","prod/v2026.06.01.1","deploy/prod/20260601-222719Z-01aa28c","prod/v2026.05.30.2","deploy/prod/20260530-171429Z-9aa3f37","prod/v2026.05.29.6","deploy/prod/20260529-211834Z-4c965f4","prod/v2026.05.29.5","deploy/prod/20260529-200948Z-f71139e","prod/v2026.05.29.4","deploy/prod/20260529-184927Z-1f7f483","prod/v2026.05.29.3","deploy/prod/20260529-142403Z-23932ec","prod/v2026.05.29.2","deploy/prod/20260529-124423Z-b292f7e","prod/v2026.05.29.1","deploy/prod/20260529-123902Z-cbbb6e7","prod/v2026.05.28.2","deploy/prod/20260528-153448Z-51967bc","prod/v2026.05.28.1","deploy/prod/20260528-141734Z-0132f1f","prod/v2026.05.27.5","deploy/prod/20260527-223753Z-7d6efae","prod/v2026.05.27.4","deploy/prod/20260527-195325Z-a920323","prod/v2026.05.27.3","deploy/prod/20260527-190912Z-57bc9f2","prod/v2026.05.27.2","deploy/prod/20260527-172940Z-30bf8f2","prod/v2026.05.27.1","deploy/prod/20260527-170544Z-5ed0ddd","prod/v2026.05.26.2","deploy/prod/20260526-171147Z-667bc55","prod/v2026.05.26.1","deploy/prod/20260526-133223Z-90de729","v0.18.0","prod/v2026.05.25.2","deploy/prod/20260525-235528Z-b62d8ca","prod/v2026.05.25.1","deploy/prod/20260525-230418Z-0194686","prod/v2026.05.24.2","deploy/prod/20260524-015922Z-963b0a5","prod/v2026.05.24.1","deploy/prod/20260524-004843Z-6a3c855","prod/v2026.05.23.3","deploy/prod/20260523-234514Z-2ad4068","prod/v2026.05.23.2","deploy/prod/20260523-223623Z-c538848","prod/v2026.05.23.1","deploy/prod/20260523-185254Z-c145166","prod/v2026.05.22.2","deploy/prod/20260522-194628Z-afd7326","prod/v2026.05.22.3","deploy/prod/20260522-203624Z-0907fae","prod/v2026.05.22.1","deploy/prod/20260522-192443Z-e22bb7d","prod/v2026.05.21.2","deploy/prod/20260521-152320Z-b07196f","prod/v2026.05.21.1","deploy/prod/20260521-030021Z-3910790","prod/v2026.05.20.3","deploy/prod/20260520-224859Z-4e4d5c8","prod/v2026.05.20.2","deploy/prod/20260520-050845Z-9be35a3","prod/v2026.05.20.1","deploy/prod/20260520-042436Z-3c45326","v0.17.0","prod/v2026.05.19.7","deploy/prod/20260519-215421Z-b753b1f","prod/v2026.05.19.6","deploy/prod/20260519-211813Z-0b888a2","prod/v2026.05.19.5","deploy/prod/20260519-055850Z-c7935b6","prod/v2026.05.19.4","deploy/prod/20260519-052642Z-4851f5f","prod/v2026.05.19.3","deploy/prod/20260519-014538Z-66f3d07","prod/v2026.05.19.2","deploy/prod/20260519-010819Z-27f0b7d","prod/v2026.05.19.1","deploy/prod/20260519-000431Z-583a48d","prod/v2026.05.18.3","deploy/prod/20260518-233609Z-6814af9","prod/v2026.05.13.8","deploy/prod/20260513-225132Z-22e994f","v0.16.0","prod/v2026.05.18.2","deploy/prod/20260518-011348Z-35aa372","prod/v2026.05.18.1","deploy/prod/20260518-001045Z-636750f","prod/v2026.05.14.2","deploy/prod/20260514-182213Z-9ab92e5","prod/v2026.05.14.1","gh-attach-assets","deploy/prod/20260514-172640Z-cccef81","prod/v2026.05.13.7","deploy/prod/20260513-223957Z-893f341","prod/v2026.05.13.6","deploy/prod/20260513-211620Z-a116d92","prod/v2026.05.13.5","deploy/prod/20260513-165224Z-a1666bb","prod/v2026.05.13.4","deploy/prod/20260513-095829Z-2763be8","prod/v2026.05.13.3","deploy/prod/20260513-073557Z-6c15a48","prod/v2026.05.13.2","deploy/prod/20260513-050836Z-72d4e7a","prod/v2026.05.13.1","deploy/prod/20260513-040344Z-f0a6789","prod/v2026.05.12.4","deploy/prod/20260512-202256Z-af96221","prod/v2026.05.12.3","deploy/prod/20260512-071923Z-dded7a5","v0.15.0","prod/v2026.05.12.2","deploy/prod/20260512-001645Z-53b64d1","prod/v2026.05.12.1","deploy/prod/20260512-000455Z-b80b942","prod/v2026.05.11.12","deploy/prod/20260511-232941Z-0c4d044","prod/v2026.05.11.11","deploy/prod/20260511-225702Z-3b2d3dc","prod/v2026.05.11.10","deploy/prod/20260511-224345Z-c1257a3","prod/v2026.05.11.9","deploy/prod/20260511-214020Z-008af4d","v0.14.0","prod/v2026.05.11.8","deploy/prod/20260511-211840Z-c51cfe2","prod/v2026.05.11.7","deploy/prod/20260511-150131Z-bb6c6c1","v0.13.0","prod/v2026.05.11.6","deploy/prod/20260511-135611Z-bac981a","prod/v2026.05.11.5","deploy/prod/20260511-134807Z-3d021d3","prod/v2026.05.11.4","deploy/prod/20260511-133638Z-a873ffb","prod/v2026.05.11.3","deploy/prod/20260511-132333Z-8287c49","prod/v2026.05.11.2","deploy/prod/20260511-074627Z-3173ecd","prod/v2026.05.11.1","deploy/prod/20260511-003126Z-5d0264d","prod/v2026.05.10.10","deploy/prod/20260510-154121Z-2dcaf25","prod/v2026.05.10.9","deploy/prod/20260510-153112Z-3d934a5","prod/v2026.05.10.8","deploy/prod/20260510-090717Z-92f5e68","prod/v2026.05.10.7","deploy/prod/20260510-090040Z-c2c0130","prod/v2026.05.10.6","deploy/prod/20260510-055252Z-3b80e3f","prod/v2026.05.10.5","deploy/prod/20260510-042607Z-003d243","prod/v2026.05.10.4","deploy/prod/20260510-015432Z-3a6ab49","prod/v2026.05.10.3","deploy/prod/20260510-011225Z-3832305","prod/v2026.05.10.2","deploy/prod/20260510-010750Z-49d77c0","prod/v2026.05.10.1","deploy/prod/20260510-010329Z-edba7e1","prod/v2026.05.09.7","deploy/prod/20260509-224311Z-4cfc137","prod/v2026.05.09.6","deploy/prod/20260509-135556Z-40627f0","prod/v2026.05.09.5","deploy/prod/20260509-134242Z-8bd7be9","prod/v2026.05.09.4","deploy/prod/20260509-125130Z-da20972","prod/v2026.05.09.3","deploy/prod/20260509-124815Z-227cce1","prod/v2026.05.09.2","deploy/prod/20260509-114209Z-ceb2561","prod/v2026.05.09.1","deploy/prod/20260509-085801Z-b6875e6","prod/v2026.05.07.3","deploy/prod/20260507-024951Z-5e7797d","prod/v2026.05.07.2","deploy/prod/20260507-003309Z-5019f2a","prod/v2026.05.07.1","deploy/prod/20260507-001319Z-e629357","prod/v2026.05.06.7","deploy/prod/20260506-211928Z-e8deec1","prod/v2026.05.06.6","deploy/prod/20260506-211420Z-678935d","prod/v2026.05.06.5","deploy/prod/20260506-201213Z-bec9362","prod/v2026.05.06.4","deploy/prod/20260506-191420Z-8d5eb14","prod/v2026.05.06.3","deploy/prod/20260506-190528Z-5aa4d13","prod/v2026.05.06.2","deploy/prod/20260506-062151Z-57308e6","prod/v2026.05.06.1","deploy/prod/20260506-061139Z-32011a1","v0.12.3","prod/v2026.05.03.2","deploy/prod/20260503-200652Z-768a501","prod/v2026.05.03.1","deploy/prod/20260503-055722Z-46354c9","prod/v2026.05.02.6","deploy/prod/20260502-230014Z-8234c92","v0.12.2","v0.12.1","prod/v2026.05.02.5","deploy/prod/20260502-200930Z-f2a61c9","prod/v2026.05.02.4","deploy/prod/20260502-200724Z-3c09df3","prod/v2026.05.02.3","deploy/prod/20260502-194452Z-6d4cf0c","prod/v2026.05.02.2","deploy/prod/20260502-194409Z-e4aa4c7","prod/v2026.05.02.1","deploy/prod/20260502-194322Z-3aff30b","v0.12.0","v0.11.0","v0.9.0","v0.8.0","v0.6.1","v0.6.0","v0.5.0","v0.3.1-beta.1","v0.3.0","v0.2.0","v0.1.0","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100603.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}