GoClaw EUVD-2026-33538

Exploitation requires an authenticated session with at least low-privilege access to the GoClaw instance (PR:L per CVSS:4.0 vector) - unauthenticated exploitation is not supported by available data. The vulnerable code path is the handleSave function within the RoleAdmin Gateway component, reachable over the network (AV:N) with no special attack requirements beyond authentication (AT:N) and no user interaction (UI:N). No non-default configuration or specific platform version beyond GoClaw ≤3.11.3 is cited as a prerequisite. Exploitation is limited by the requirement to hold a valid account on the target GoClaw instance; organizations that do not permit external user registration or that restrict account creation significantly reduce their real-world exposure. Impact is further constrained to low-level confidentiality, integrity, and availability effects with no lateral impact to connected systems (SC:N/SI:N/SA:N).

The CVSS 4.0 score of 2.1 (LOW) is consistent with the constrained impact profile: all three CIA sub-scores are Low (VC:L/VI:L/VA:L), there is no scope change (SC:N/SI:N/SA:N), and exploitation requires low privileges (PR:L). The attack vector is network (AV:N) with low complexity (AC:L) and no attack requirements (AT:N) or user interaction (UI:N), meaning exploitation is straightforward once an attacker holds a valid low-privilege session. Exploit maturity is rated E:P (proof-of-concept), which aligns with the publicly available GitHub-linked exploit. No EPSS data was provided, and the CVE is not listed in the CISA KEV catalog, suggesting no confirmed widespread or targeted active exploitation at time of analysis. The practical risk is bounded: an attacker must first obtain authenticated access before leveraging the flaw. For organizations that expose GoClaw externally or allow broad user registration, the combination of low-barrier exploitation (AC:L, AT:N, UI:N post-auth) and available POC code meaningfully raises the exploitation likelihood compared to what the raw CVSS score implies.

An attacker with a valid low-privilege GoClaw account sends a crafted HTTP request to the RoleAdmin Gateway's handleSave endpoint, exploiting the absent or bypassable privilege check in tts_config.go to perform administrative configuration actions. Because a proof-of-concept has been published on GitHub (issue #1118), the mechanics of triggering the flaw are publicly documented, lowering the skill threshold for exploitation. The attacker gains elevated access within the application, potentially modifying TTS configuration in ways restricted to administrators.