PT-2026-60996 · Sipeed · Picoclaw

Eric-I · CVE-2026-16197 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sipeed PicoClaw versions prior to 0.3.0

Description An issue in the Group Message Handler component allows for missing authorization. This occurs within the handleMessageReceive() function located in the pkg/channels/feishu/feishu 64.go file. The flaw can be exploited remotely.

Recommendations Update Sipeed PicoClaw to version 0.3.0 or later. As a temporary mitigation, restrict access to the handleMessageReceive() function.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2026-16197

Affected Products

Picoclaw

References · 9

• 🔥 https://github.com/sipeed/picoclaw/issues/3082 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16197 · Security Note
• https://vuldb.com/submit/852964 · Note
• https://twitter.com/infoflowcloud/status/2078619796652884024 · Twitter Post
• https://twitter.com/CVEnew/status/2078618640476254509 · Twitter Post
• https://vuldb.com/cve/CVE-2026-16197 · Note
• https://github.com/sipeed/picoclaw · Note
• https://vuldb.com/vuln/380013 · Note
• https://vuldb.com/vuln/380013/cti · Note