CVE-2026-10217

2.1 lowEPSS 0.2%

Low (2.1). EPSS 0.2% chance of exploitation in the next 30 days.

A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the component RoleAdmin Gateway. This manipulation causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project tagged the reported issue as bug.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWEs: CWE-266, CWE-269
Published: 2026-06-01
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

References

https://github.com/nextlevelbuilder/goclaw/
https://github.com/nextlevelbuilder/goclaw/issues/1118
https://vuldb.com/cve/CVE-2026-10217
https://vuldb.com/submit/821937
https://vuldb.com/vuln/367496

Check your stack JSON