CVE-2026-7505
Improper Authorization in GoClaw and GoClaw Lite
Publication date: 2026-04-30
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextlevelbuilder | goclaw | to 3.8.5 (inc) |
| nextlevelbuilder | goclaw_lite | to 3.8.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw found in nextlevelbuilder GoClaw and GoClaw Lite up to version 3.8.5. It affects an unknown function within the RPC Handler component, causing improper authorization. This means that the system does not correctly verify permissions, potentially allowing unauthorized access or actions. The attack exploiting this flaw can be initiated remotely.
The vulnerability has been publicly disclosed and an exploit is available. Upgrading to version 3.9.0 of the software mitigates this issue.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to remotely exploit the improper authorization flaw in the RPC Handler component. This could lead to unauthorized access or actions within the affected software, potentially compromising the confidentiality, integrity, and availability of your system or data.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the affected component, nextlevelbuilder GoClaw or GoClaw Lite, to version 3.9.0.
This upgrade addresses the improper authorization flaw in the RPC Handler component that can be exploited remotely.