CVE-2026-100604

The ClawHub application/backend contains an incorrect authorization vulnerability where organization-owned skills retain the ownerUserId of their original publisher. Because lifecycle and transfer checks trust this historical user instead of current organization privileges, an authenticated user ...