CVE-2026-100602

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650

Description The application backend contains a missing authorization check within the changelog preview feature. An authenticated user can trigger the skills:generateChangelogPreview action for a skill they are not permitted to access. This allows the system to read the previous version of the skill without enforcing standard file-read authorization, potentially sending up to 8,000 characters of quarantined content to an AI provider and returning it in the preview, which leads to the disclosure of restricted skill content.

Recommendations Update to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or a later descendant.