Log in Start free

Vulnerability · Published Jun 1, 2026 · Assigned by VulDB

CVE-2026-10217nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management

Medium 6.3

In plain English

A medium-severity privilege mismanagement in GoClaw from nextlevelbuilder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 88.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the component RoleAdmin Gateway. This manipulation causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project tagged the reported issue as bug.

Affected products (as reported)

VendorProductVersions
nextlevelbuilder GoClaw 3.11.03.11.13.11.23.11.3

Weakness: CWE-269, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References