CVE-2026-7505

nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization

State: Published
Severity: 6.9 Medium
Published: Apr 30, 2026
Updated: May 1, 2026
Reserved: Apr 30, 2026

Description

A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 3.9.0 mitigates this issue. Patch name: 406022e79f4a18b3070a446712080571eff11e30. You should upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
GoClawnextlevelbuilder	3.8.0Affected 3.8.1Affected 3.8.2Affected 3.8.3Affected 3.8.4Affected 3.8.5Affected 3.9.0Not affected
GoClaw Litenextlevelbuilder	3.8.0Affected 3.8.1Affected 3.8.2Affected 3.8.3Affected 3.8.4Affected 3.8.5Affected 3.9.0Not affected

References

VDB-360314 | nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorizationvdb-entry
VDB-360314 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
Submit #803458 | Goclaw V0.4.0 Command executionthird-party-advisory
https://github.com/nextlevelbuilder/goclaw/issues/866exploitissue-tracking
https://github.com/nextlevelbuilder/goclaw/pull/950issue-trackingpatch
https://github.com/nextlevelbuilder/goclaw/commit/406022e79f4a18b3070a446712080571eff11e30patch
https://github.com/nextlevelbuilder/goclaw/releases/tag/v3.9.0patch
https://github.com/nextlevelbuilder/goclaw/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.