CVE-2026-16197

Received Received - Intake

Missing Authorization in Sipeed PicoClaw

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulDB

Description

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically due to inactivity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-18

Last Modified

2026-07-18

Generated

2026-07-19

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-16197

EUVD

EUVD-2026-45408

Affected Vendors & Products

Vendor	Product	Version / Range
sipeed	pico_claw	to 0.2.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is in Sipeed PicoClaw up to version 0.2.9, specifically in the Group Message Handler component. The issue is in the handleMessageReceive function of the file pkg/channels/feishu/feishu_64.go, where missing authorization checks allow remote attackers to manipulate message handling without proper validation.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. The vulnerability involves a missing authorization issue in the Sipeed PicoClaw software up to version 0.2.9, specifically in the Group Message Handler component.

Impact Analysis

The vulnerability allows remote attackers to bypass authorization and potentially access or manipulate sensitive data processed by the Group Message Handler. This could lead to unauthorized actions, data leaks, or system misuse depending on the application's use of PicoClaw.

Compliance Impact

The vulnerability involves missing authorization in a remote communication function, which could lead to unauthorized access or data exposure. This may impact compliance with GDPR (data protection) and HIPAA (health data privacy) by increasing risks of unauthorized data handling or breaches.

Mitigation Strategies

Immediately upgrade Sipeed PicoClaw to a version beyond 0.2.9 where the vulnerability is patched. If no patch is available, disable the Group Message Handler component or restrict network access to it until a fix is applied.

Hi! I’m here to help you understand CVE-2026-16197. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70