This vulnerability affects the handleMessageReceive function in the pkg/channels/feishu/feishu_64.go file of Sipeed PicoClaw versions 0.2.0 through 0.2.9. It results in missing authorization checks, allowing an attacker to remotely manipulate the system without proper permissions. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Although the exploit is publicly disclosed, no official fix or patch has been documented, and the vendor has not provided remediation guidance.

The vulnerability allows remote attackers to bypass authorization controls in the affected function, potentially leading to unauthorized actions within the Group Message Handler component. This could compromise the integrity or functionality of the affected system. However, the CVSS score indicates a medium impact level, suggesting limited scope or exploit complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected service or implementing compensating controls to limit exposure to untrusted sources.