This vulnerability affects the ToolsInvokeHandler.ServeHTTP function in the internal/http/tools_invoke.go file of nextlevelbuilder GoClaw versions 3.13.0 through 3.13.2. It causes missing authorization, allowing an attacker to remotely invoke the affected endpoint without proper permission checks. The weakness is publicly known and exploit code has been released, increasing the risk of exploitation. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch is currently available, and the product is not a cloud service.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the ToolsInvokeHandler.ServeHTTP function, potentially allowing unauthorized access or actions through the Invoke Endpoint component. The exact impact depends on what the endpoint controls, but unauthorized access could lead to information disclosure or unauthorized operations within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected endpoint or implementing additional access controls at the network or application layer to mitigate unauthorized use.