The vulnerability CVE-2026-10616 affects nextlevelbuilder GoClaw versions 3.11.0 through 3.11.3. It is caused by missing authorization in the TeamTasksTool.executeComplete function located in internal/tools/team_tasks_lifecycle.go. This flaw allows an attacker with low privileges to remotely manipulate the function, bypassing authorization controls. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required. Although the exploit is publicly available, there is no vendor advisory or patch information provided at this time.

An attacker with low privileges can remotely exploit this vulnerability to bypass authorization checks in the Team Task Completion Handler, potentially allowing unauthorized completion of team tasks. This could lead to unauthorized actions within the application context. The vulnerability does not require user interaction and has a medium severity score, indicating a moderate risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor nextlevelbuilder's communications for updates. Until a patch is available, restrict access to the affected functionality to trusted users only and consider implementing additional access controls or monitoring for suspicious activity related to the TeamTasksTool.executeComplete function.