The vulnerability resides in the auth function within the evolution_handlers.go file of GoClaw. An attacker can craft a request that bypasses the intended authorization logic, allowing unauthorized access or operation execution. This weakness is categorized as improper authorization, aligning with CWE-266 and CWE-285, and can expose sensitive actions to unauthenticated or insufficiently authenticated users.

GoClaw versions up to 3.11.3 are affected. Users running v3.11.3 or earlier of the GoClaw application must check for a newer release that patches the auth logic.

The CVSS score of 5.3 indicates moderate severity, and the lack of an EPSS score suggests insufficient publicly known exploitation data. However, the description explicitly states the attack can be executed remotely, making it potentially exploitable by adversaries with network reach to the service. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation is documented but the public disclosure and remote execution capability raise concerns for environments that expose this feature to the internet.