OpenClaw Vulnerability Advisory CVE-799: Auth Bypass via Skill Reporting

Key Vulnerability Information Summary Vulnerability Overview CVE ID: CVE-799 Severity: Moderate Vulnerability Description: Four distinct regular accounts can coordinate reports to automatically hide any skill without requiring moderator approval. The report quota is counted only against visible targets, allowing an account to repeat the operation on other skills after hiding one. Official skills are not exempt. Impact Scope: Affects the application/backend. The npm CLI and OpenClaw runtime are independent products. Affected Versions: through Fixed Version: Remediation Fix Commit: PR #3631 Fixed Version: Deployment Recommendation: Self-hosted deployments should update to this version or higher. Validation: Five-fold validation passed (6,663 tests, static analysis, schema/CLI/Dunam and pkg/build TypeScript checks, build verification, and source code review). Regression Verification The pre-fix version exhibited after the fourth distinct report. Authenticated runtime tests covered official and regular skills, four training reports, rejection of duplicate reports, moderation permissions for rejected reports, and successful moderation for hidden items. Local Convex backend tests: Four distinct authenticated users reported official skills via the public route. The mutation result changed to: . All tests passed: 6,621 tests, 497 passing files, 1 skipped. Severity Assessment Assessment: Moderate Rationale: Exploitation requires reports from four distinct authenticated accounts, and the impact is limited to the visibility and availability of target directory entries. Reports can be repeated against already-added targets, and the demonstrated operation is a reversible hide rather than permanent deletion, code modification, or exposure of private data. Note: This is a qualitative assessment by maintainers; no numerical CVSS score was assigned. The severity description refers to the vulnerability in the affected versions, independent of any completed hosted deployments.

Goal Reached Thanks to every supporter — we hit 100%!

OpenClaw Vulnerability Advisory CVE-799: Auth Bypass via Skill Reporting

More from this source