CVE-2026-100603

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650

Description A flaw exists in the skill report moderation flow of the application backend. Four distinct authenticated accounts can report a visible skill to trigger its automatic hiding from the catalog by setting the moderationStatus to hidden without requiring a moderator decision. Since the reporter quota only tracks reports against visible targets, the same accounts can repeatedly hide multiple skills, including official ones.

Recommendations Update self-hosted deployments to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or a later descendant.