EUVD-2026-33538
GHSA-xvg5-76pr-547q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the component RoleAdmin Gateway. This manipulation causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project tagged the reported issue as bug.
AnalysisAI
Improper privilege management in nextlevelbuilder GoClaw up to version 3.11.3 allows authenticated low-privileged users to escalate privileges via the handleSave function of the RoleAdmin Gateway component (internal/http/tts_config.go). The vulnerability is remotely exploitable over the network with no user interaction required, though a low-privilege authenticated session is a prerequisite per the CVSS:4.0 vector (PR:L). A publicly available proof-of-concept exists (published via GitHub issue #1118), but this CVE has not been added to the CISA KEV catalog. The CVSS 4.0 base score of 2.1 (LOW) reflects constrained confidentiality, integrity, and availability impact with no scope change to downstream systems.
Technical ContextAI
GoClaw is a Go-based application developed by nextlevelbuilder. The vulnerable code resides in internal/http/tts_config.go, specifically within the handleSave function of what is described as the RoleAdmin Gateway - a component likely responsible for routing or enforcing role-based access control over administrative TTS (text-to-speech) configuration operations. The root cause is classified as CWE-269 (Improper Privilege Management), meaning the application fails to correctly enforce privilege boundaries when saving configuration data through this gateway. This class of flaw typically arises when role checks are absent, bypassable, or applied inconsistently - allowing a lower-privileged role to invoke functionality intended only for administrators. The CPE string cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:* covers all versions without a lower bound, indicating the version range is not precisely constrained beyond the stated upper limit of 3.11.3.
RemediationAI
No vendor-released patched version has been independently confirmed at the time of analysis. The project acknowledged the issue by tagging it as a bug (referenced in GitHub issue #1118 at https://github.com/nextlevelbuilder/goclaw/issues/1118). Operators should monitor the upstream repository at https://github.com/nextlevelbuilder/goclaw for a remediation commit or tagged release. As a compensating control, restrict access to the RoleAdmin Gateway and the TTS configuration save endpoint to only trusted, explicitly authorized administrator accounts - this limits exploitation to accounts that should already have elevated access, effectively neutralizing the privilege escalation path. Additionally, audit existing low-privilege accounts for any unauthorized configuration changes made via handleSave. If GoClaw is exposed externally, consider placing the admin gateway behind network-layer controls (firewall rules, VPN, or IP allowlisting) to reduce the attacker pool until a patch is available. Note that IP allowlisting does not address insider threat or already-compromised low-privilege accounts.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today