EUVD-2026-45378
GHSA-jx43-52cp-c9vc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebSocket endpoint with low-privilege auth required; no scope change; all three impacts bounded at Low per CVSS 4.0 VC/VI/VA ratings.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
AnalysisAI
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access controls in the RequestApproval function, potentially approving privileged operations without proper authorization. All versions up to and including 3.13.2 of nextlevelbuilder/goclaw are affected. A public exploit has been disclosed via GitHub, though no CISA KEV listing confirms active exploitation at this time.
Technical ContextAI
GoClaw (cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*) is an open-source tool by nextlevelbuilder exposing a WebSocket-based approval workflow. The vulnerable code resides in internal/tools/exec_approval.go within the RequestApproval function, which handles incoming approval decisions over a persistent WebSocket connection. CWE-863 (Incorrect Authorization) indicates that while authentication is enforced (PR:L in the CVSS 4.0 vector), the authorization logic fails to validate whether the authenticated principal holds sufficient privilege to act on approval requests - a classic confused-deputy or privilege escalation pattern within an approval workflow. The WebSocket transport means the attack surface is persistent and potentially bidirectional, complicating detection compared to standard HTTP endpoints.
RemediationAI
Upstream fix availability (PR/commit) is referenced via GitHub issue https://github.com/nextlevelbuilder/goclaw/issues/1212, but a tagged patched release version has not been independently confirmed from the available data - operators should monitor the repository at https://github.com/nextlevelbuilder/goclaw/ for a versioned release addressing this issue and upgrade as soon as one is available. As a compensating control prior to patching, restrict network access to the WebSocket Approval Endpoint using firewall rules or reverse-proxy ACLs, limiting connections to explicitly trusted principals or IP ranges; note this does not fix the authorization logic but substantially reduces exposure. Additionally, review access logs for the RequestApproval endpoint for anomalous approval activity from low-privileged accounts, as the public PoC makes detection via behavioral baselines practical.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today