ClawHub contains an incorrect authorization vulnerability. A skill that belongs to an organization retains the ownerUserId of its original publisher. When the system checks for transfer, deletion, or restoration, it trusts the original publisher's ID rather than the current organization privileges. Consequently, an authenticated user who had once published the skill can perform those operations even after their organization permissions have been revoked or downgraded. This allows the user to take control of the skill’s name and historical data and to disrupt or impersonate the organization’s work.

The affected product is the openclaw:clawhub backend used on the clawhub.ai service and in self‑hosted deployments. All released revisions before 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 may be vulnerable; the exact range of affected releases has not been fully determined. The npm CLI and OpenClaw runtime are not impacted by this flaw.

The CVSS base score of 5.3 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Although no EPSS score is available, the exploit requires authentication as a former publisher, making it an internal risk that can be realistically triggered by privileged users or compromised accounts. Because the flaw provides a form of privilege escalation, it should be addressed promptly. The vulnerability can be mitigated by applying the patch that incorporates PR #3680, released in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, or any later descendant.