CVE-2026-16119 is an authorization bypass vulnerability affecting nextlevelbuilder GoClaw up to version 3.13.2. The issue resides in the RequestApproval function within internal/tools/exec_approval.go, part of the WebSocket Approval Endpoint component. This flaw allows remote attackers to manipulate requests to bypass intended authorization controls. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Although an exploit has been publicly disclosed, there is no vendor advisory or patch available at this time.

Successful exploitation of this vulnerability could allow remote attackers to bypass authorization checks in the WebSocket Approval Endpoint of GoClaw, potentially granting unauthorized access or approval capabilities. The medium CVSS score reflects limited but meaningful impact due to the authorization bypass. There is no indication of privilege escalation, confidentiality, integrity, or availability impacts beyond the authorization issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the WebSocket Approval Endpoint or implementing additional access controls to mitigate unauthorized requests. Monitor vendor channels for updates and apply patches promptly once available.