PT-2026-45820 · Goclaw · Goclaw

Eric-H · CVE-2026-10616 · Published 2026-06-02 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoClaw versions prior to 3.11.4

Description A weakness in the Team Task Completion Handler component allows for missing authorization. This issue occurs within the TeamTasksTool.executeComplete() function located in the internal/tools/team tasks lifecycle.go file. A remote attacker can exploit this flaw by executing a manipulation to bypass authorization controls.

Recommendations Update to version 3.11.4 or later. As a temporary workaround, restrict access to the TeamTasksTool.executeComplete() function until the update is applied.

Exploit

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

CVE-2026-10616

Affected Products

Goclaw

References · 10

• 🔥 https://github.com/nextlevelbuilder/goclaw/issues/1133 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10616.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10616 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10616 · Vendor Advisory
• https://github.com/nextlevelbuilder/goclaw · Note
• https://vuldb.com/vuln/367925/cti · Note
• https://t.me/cveNotify/165991 · Telegram Post
• https://vuldb.com/submit/829420 · Note
• https://vuldb.com/cve/CVE-2026-10616 · Note
• https://vuldb.com/vuln/367925 · Note