This vulnerability in poco-ai poco-claw up to version 0.5.4 involves an authorization bypass in the get_workspace_file function of executor_manager/app/api/v1/workspace.py. By manipulating the user_id argument, an attacker can bypass authorization controls remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). Although an exploit is publicly available, no official remediation level or patch link is provided in the source data. The vendor has released a patch identified by commit 67fcc88505c57f77d3fcf04eb5b89425b10cbf48, and upgrading to a fixed version is advised.

Successful exploitation allows an unauthenticated remote attacker to bypass authorization checks in the Workspace API, potentially accessing workspace files they should not be authorized to view or manipulate. This could lead to unauthorized data exposure or modification within the affected component.

A patch is available as indicated by the commit 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Users should upgrade poco-claw to a version that includes this fix. Since no official vendor advisory or remediation level is provided, confirm patch availability and upgrade instructions from the official poco-ai project repository or vendor channels. Patch status is not yet confirmed by a vendor advisory; check the vendor advisory for current remediation guidance.