This vulnerability in nanocoai NanoClaw (versions 2.0.0 through 2.0.64) involves improper authorization in the handleAddMcpServer function of the add_mcp_server component (src/modules/self-mod/request.ts). The flaw allows an attacker to remotely manipulate the function to bypass authorization controls. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. A patch exists identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8, though no explicit vendor advisory or remediation level is provided.

Successful exploitation can lead to improper authorization, potentially allowing unauthorized remote actors to perform actions restricted by authorization controls in the affected NanoClaw component. The impact is rated medium severity with limited impact on confidentiality, integrity, and availability.

A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 should be applied to remediate this issue. Patch status is not yet confirmed by a vendor advisory; users should verify the availability and applicability of this patch from official nanocoai sources before deployment.