EUVD-2026-34002
GHSA-cq6h-h9c3-mq74
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/team_tasks_lifecycle.go of the component Team Task Completion Handler. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
AnalysisAI
Missing authorization in nextlevelbuilder GoClaw up to version 3.11.3 allows low-privileged remote attackers to trigger unauthorized team task completions via the TeamTasksTool.executeComplete function. The flaw, classified as CWE-862, permits any authenticated user to bypass permission checks in the Team Task Completion Handler, falsely marking tasks as complete regardless of their authorization level. A publicly available exploit exists (referenced in GitHub issue #1133), though no public exploit confirmed in active exploitation - the vulnerability is not listed in CISA KEV, and its CVSS 4.0 score of 2.1 reflects the limited integrity-only impact.
Technical ContextAI
GoClaw is a project management and task orchestration application developed by nextlevelbuilder, hosted on GitHub. The vulnerability exists in the function TeamTasksTool.executeComplete within internal/tools/team_tasks_lifecycle.go, which handles the lifecycle transition of team tasks to a completed state. CWE-862 (Missing Authorization) identifies the root cause as a failure to verify whether the calling user holds sufficient permissions before executing the task completion action - the function performs the operation without an adequate authorization gate. The CPE string cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:* covers all versions through 3.11.3 as affected. Despite being tagged 'Authentication Bypass,' the more precise characterization is a broken access control scenario: authentication is required (PR:L in CVSS), but the authorization check within the handler is absent or insufficient.
RemediationAI
No specific patched release version has been confirmed in the available data - the fix status should be actively monitored against the GitHub repository at https://github.com/nextlevelbuilder/goclaw and the VulDB advisory at https://vuldb.com/vuln/367925. The project has acknowledged this as a bug (GitHub issue #1133 at https://github.com/nextlevelbuilder/goclaw/issues/1133), indicating a fix may be forthcoming. As an interim compensating control, restrict access to the team task completion API endpoint to only users with explicitly authorized roles via an API gateway, reverse proxy ACL, or middleware layer - this avoids modifying application code but introduces an operational dependency on network-layer enforcement. Alternatively, if team task completion is not required for all user roles, disable or restrict the feature at the application configuration level. Once a patched version above 3.11.3 is released and independently confirmed, upgrade immediately. Note that network-layer mitigations do not address the root authorization defect and should be treated as temporary.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today