EUVD-2026-45175
GHSA-xp4x-w877-82xm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires only low-privilege auth (PR:L); no scope change; all three impacts low since only cron job data is exposed or deletable.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".
AnalysisAI
Missing authorization in mosaxiv clawlet up to version 0.2.10 allows low-privileged remote attackers to list and remove cron jobs through the cron Chat Tool component without proper permission checks. The affected functions are list and remove in tools/tool_cron.go, enabling unauthorized enumeration and deletion of scheduled tasks. A public exploit exists via the project's GitHub issue tracker; the maintainer closed the report as 'not planned,' meaning no vendor patch is forthcoming.
Technical ContextAI
clawlet (CPE: cpe:2.3:a:mosaxiv:clawlet:*:*:*:*:*:*:*:*) is a Go-based chat tool that includes cron job management functionality. The root cause is CWE-862 (Missing Authorization): the list and remove handler functions in tools/tool_cron.go execute cron job operations without verifying that the calling user holds the necessary permissions to do so. This is a classic authorization enforcement gap - authentication may be present (PR:L in the CVSS vector confirms a session is required), but no subsequent privilege check gates the sensitive cron operations. Because the CVSS 4.0 vector shows AV:N/AC:L/AT:N, the endpoint is reachable over the network with no special conditions or timing requirements.
RemediationAI
No vendor-released patch exists and none is planned - the GitHub issue was closed as 'not planned' (https://github.com/mosaxiv/clawlet/issues/17). Operators should consider removing or disabling the cron Chat Tool feature entirely if it is not operationally required, which eliminates the attack surface with no functional loss to unaffected features. If the cron tool must remain active, restrict network access to the application to trusted internal networks or authenticated VPN users only, reducing the pool of low-privileged accounts that can reach the vulnerable endpoint. An application-layer reverse proxy can be configured to block requests to the cron tool's list and remove routes as an additional control. Operators should also audit existing cron jobs for unauthorized modifications given the availability of public exploit code. Upgrading beyond 0.2.10 is not a remediation path at this time.
Server-side request forgery in mosaxiv clawlet up to version 0.2.10 enables authenticated remote attackers to manipulate
Link-following vulnerability in mosaxiv clawlet up to version 0.2.10 allows local low-privileged attackers to read, writ
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today