This vulnerability in nextlevelbuilder GoClaw versions 3.13.3-beta.0 through 3.13.3-beta.3 involves improper authorization in the ExecTool.Execute function located in goclaw/internal/tools/credentialed_exec.go. An attacker can remotely manipulate this function to bypass authorization controls. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. Although exploit code is publicly available, no active exploitation has been reported. The vendor has not provided an official fix or remediation at this time.

Successful exploitation could allow an attacker to perform actions without proper authorization remotely, potentially leading to unauthorized operations within the affected GoClaw component. The impact on confidentiality, integrity, and availability is rated as low, consistent with the CVSS score of 5.3 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should monitor vendor communications for updates. Until a fix is available, consider restricting network access to the vulnerable functionality if possible.