This vulnerability affects nextlevelbuilder GoClaw up to version 3.13.2, specifically in the extractBin/RequestApproval/matchesAllowlist function of internal/tools/exec_approval.go. The issue results in incorrect authorization, potentially allowing unauthorized users with high privileges to perform actions they should not be permitted to. The CVSS 4.8 score reflects a medium impact with attack vector being adjacent network and requiring high privileges. Exploit code has been publicly disclosed, increasing the risk of exploitation. No official fix or patch has been announced as of the publication date.

The vulnerability leads to incorrect authorization, which may allow unauthorized actions within the affected function. The CVSS vector indicates that an attacker with high privileges on an adjacent network could exploit this without user interaction, potentially leading to limited confidentiality, integrity, and availability impacts. Since the exploit is public, there is an increased risk of exploitation despite no confirmed active attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality and monitor for suspicious activity related to authorization bypass attempts. Avoid exposing the affected service to untrusted networks where possible.