CVE-2026-7505 json
nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization
published 2026-04-30 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-26453
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 3.9.0 mitigates this issue. Patch name: 406022e79f4a18b3070a446712080571eff11e30. You should upgrade the affected component.
Patch / fix
- nextlevelbuilder GoClaw 3.9.0
- nextlevelbuilder GoClaw Lite 3.9.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/nextlevelbuilder/goclaw/issues/866 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 7.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- nextlevelbuilder GoClaw
- nextlevelbuilder GoClaw Lite
Classification
References
-
github.com
/nextlevelbuilder/goclaw/pull/950
issue-tracking, patch
-
github.com
/nextlevelbuilder/goclaw/commit/406022e79f4a18b3070a446712080571eff11e30
patch
-
github.com
/nextlevelbuilder/goclaw/releases/tag/v3.9.0
patch
-
github.com
/nextlevelbuilder/goclaw/issues/866
exploit, issue-tracking
-
vuldb.com
/vuln/360314
vdb-entry
-
vuldb.com
/vuln/360314/cti
signature, permissions-required
-
vuldb.com
/submit/803458
third-party-advisory
-
github.com
/nextlevelbuilder/goclaw/
product
Sources
- CVE List CVE-2026-7505
- NVD CVE-2026-7505
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.