CVE-2026-16195: Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-18 · updated 2026-10-24
Weakness: CWE-285

Description

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Affected products

Sipeed PicoClaw: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5 (+4)

References

https://github.com/sipeed/picoclaw/
https://github.com/sipeed/picoclaw/issues/3076
https://vuldb.com/cve/CVE-2026-16195
https://vuldb.com/submit/852962
https://vuldb.com/vuln/380011
https://vuldb.com/vuln/380011/cti

Get alerted when CVE-2026-16195 or the next vulnerability affects your stack