A flaw in the TeamTasksTool.executeComplete function of the GoClaw Task Task Completion Handler allows an attacker to skip required authorization checks. When exploited, a remote user can force any team task to be marked completed without possessing the necessary permissions. The vulnerability stems from missing verification of the caller’s privileges before executing the state change, thereby compromising the integrity of task management. Consequently, untrusted users could prematurely finish tasks or alter task outcomes, potentially disrupting workflow and trust in the system.

The weakness is present in all releases of nextlevelbuilder:GoClaw up to and including version 3.11.3. The affected code resides in internal/tools/team_tasks_lifecycle.go within the Team Task Completion Handler component.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is remote; public exploits are available, which suggests that an attacker may leverage the flaw through exposed external interfaces. Because the problem involves authorization logic, it can lead to unauthorized privilege increases and data integrity issues. The risk remains significant, especially in environments where the GoClaw instance is exposed to untrusted networks.