ClawHub has a missing authorization check in the changelog preview feature. A signed‑in user can call the public skills:generateChangelogPreview action on a skill they are not authorized to view; the previous version of the skill is read without the normal file‑read permissions, and up to 8,000 characters of restricted content can be sent to an AI provider and reflected in the preview returned to the caller, revealing protected skill content. The flaw is a classic missing authorization weakness (CWE‑862), allowing disclosed data that should be confidential to be exposed to any authenticated user.

Vulnerable installations of openclaw:clawhub, including self‑hosted deployments with revisions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650. The fix is available in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 and was deployed to clawhub.ai on 2026‑09‑11. The npm CLI and OpenClaw runtime are not affected.

The CVSS score of 7.1 reflects a moderate‑to‑high severity. Exploitation requires the attacker to be authenticated; an attacker with a legitimate user account can trigger the preview endpoint, bypassing authorization, and retrieve up to 8,000 characters of hidden content. No external exploit code or zero‑day conditions are required, and EPSS data is unavailable, so the likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but because it leaks proprietary skill data, it should be treated with care.