This vulnerability exists in the _select_tools function of the file agent/evolution/executor.py within the Self-Evolution Review Agent component of zhayujie CowAgent up to version 2.1.1. The flaw leads to incorrect authorization, potentially allowing remote attackers with low privileges to perform unauthorized actions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. Public exploit code is available, increasing the risk of exploitation.

The vulnerability can be exploited remotely to bypass proper authorization checks, potentially allowing attackers to perform unauthorized actions with limited privileges. The impact is rated low, with partial loss of confidentiality, integrity, and availability possible. No reports of active exploitation in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor channels for updates. Until a fix is available, consider restricting network access to the affected component and applying compensating controls to limit exposure.