EUVD-2026-33539
GHSA-j6m2-hpv6-29c4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in nextlevelbuilder GoClaw up to 3.11.3. This affects the function auth of the file internal/http/evolution_handlers.go. Such manipulation leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project tagged the reported issue as bug.
AnalysisAI
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker to bypass authorization controls via the auth function in internal/http/evolution_handlers.go. The CVSS 4.0 score is 2.1 with limited integrity and availability impact and no confidentiality exposure. A public proof-of-concept exploit has been disclosed via a GitHub issue, though the project has not been confirmed as actively exploited in the wild per CISA KEV.
Technical ContextAI
GoClaw is a Go-based application developed by nextlevelbuilder (CPE: cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*). The vulnerable code resides in the HTTP handler layer at internal/http/evolution_handlers.go, specifically in the auth function responsible for enforcing authorization decisions on evolution-related endpoints. The root cause is classified as CWE-285 (Improper Authorization), meaning the function either skips, misapplies, or inadequately enforces access control checks, allowing a low-privileged user to perform operations beyond their intended permission boundary. This is a logic flaw in access control rather than a memory corruption or injection issue.
RemediationAI
No vendor-released patched version has been identified in the available data at time of analysis - the project tagged the issue as a bug via GitHub issue #1120 (https://github.com/nextlevelbuilder/goclaw/issues/1120), but no corresponding fix commit or tagged release version was provided in the references. Monitor the GoClaw GitHub repository (https://github.com/nextlevelbuilder/goclaw) for a patch release. As a compensating control, restrict access to the affected HTTP endpoints (evolution-related routes handled by evolution_handlers.go) via network-layer controls such as firewall rules or API gateway authorization policies, limiting exposure to only trusted, authenticated users who require access. Additionally, enforce principle of least privilege for accounts that interact with the GoClaw service to reduce the attacker's ability to leverage low-privilege credentials. Note that restricting endpoint access may impact legitimate evolution workflow functionality if those routes are in active use.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today