PT-2026-36210 · Nextlevelbuilder · Goclaw+1

Aisec · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-7505

Mitre

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 3.9.0 mitigates this issue. Patch name: 406022e79f4a18b3070a446712080571eff11e30. You should upgrade the affected component.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-7505

Affected Products

Goclaw

Goclaw Lite

References · 9

• 🔥 https://github.com/nextlevelbuilder/goclaw/issues/866 · Exploit
• https://github.com/nextlevelbuilder/goclaw/commit/406022e79f4a18b3070a446712080571eff11e30 · Patch
• https://github.com/nextlevelbuilder/goclaw/releases/tag/v3.9.0 · Patch
• https://github.com/nextlevelbuilder/goclaw/pull/950 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7505 · Security Note
• https://vuldb.com/submit/803458 · Note
• https://github.com/nextlevelbuilder/goclaw · Note
• https://vuldb.com/vuln/360314 · Note
• https://vuldb.com/vuln/360314/cti · Note