The vulnerability CVE-2026-10616 affects nextlevelbuilder GoClaw up to version 3.11.3. It is caused by missing authorization validation in the TeamTasksTool.executeComplete function located in internal/tools/team_tasks_lifecycle.go. This flaw allows remote attackers to execute unauthorized actions related to team task completion. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although an exploit is publicly available, no vendor-provided fix or mitigation details are currently documented.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to bypass authorization controls in the Team Task Completion Handler, potentially enabling unauthorized task completion actions. This could affect the integrity of task management processes within GoClaw. There is no indication of privilege escalation beyond the described scope or direct impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected functionality to trusted users only and apply compensating controls if feasible.