CVE-2026-10217: nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-01 · updated 2026-07-22
Weakness: CWE-266

Description

A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the component RoleAdmin Gateway. This manipulation causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project tagged the reported issue as bug.

Affected products

nextlevelbuilder GoClaw: 3.11.0, 3.11.1, 3.11.2, 3.11.3

References

https://github.com/nextlevelbuilder/goclaw/
https://github.com/nextlevelbuilder/goclaw/issues/1118
https://vuldb.com/cve/CVE-2026-10217
https://vuldb.com/submit/821937
https://vuldb.com/vuln/367496
https://vuldb.com/vuln/367496/cti

Get alerted when CVE-2026-10217 or the next vulnerability affects your stack