Description
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".
Published: 2026-07-17
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the list/remove function of tools/tool_cron.go within the Clawlet cron chat component. It allows a requestor to delete chat records without any authorization checks. This missing authorization (CWE-862) and missing access control (CWE-863) can be exploited remotely to alter or delete data, affecting the integrity and availability of the chat subsystem.

Affected Systems

Mosaxiv Clawlet versions up to and including 0.2.10 are affected. The flaw resides in the cron chat component, specifically the list/remove operation implemented in tools/tool_cron.go.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity, and the EPSS score of < 1% indicates a very low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Publicly available code demonstrates that an attacker can invoke the vulnerable operation from a remote location to delete chat entries without authentication.

Generated by OpenCVE AI on August 1, 2026 at 08:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mosaxiv Clawlet to the latest release that fixes the missing authorization check in tools/tool_cron.go.
  • If an upgrade is not immediately available, modify the list/remove handler to enforce an explicit authorization check ensuring only privileged users can perform deletions.
  • Limit remote access to the Clawlet cron chat service by firewall rules or restricting usage to trusted hosts or secure tunnels.
  • Enable detailed logging of all delete attempts and monitor for anomalous activity.

Generated by OpenCVE AI on August 1, 2026 at 08:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".
Title mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
First Time appeared Mosaxiv
Mosaxiv clawlet
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:mosaxiv:clawlet:*:*:*:*:*:*:*:*
Vendors & Products Mosaxiv
Mosaxiv clawlet
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mosaxiv Clawlet
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-17T17:27:24.361Z

Reserved: 2026-07-17T05:47:46.367Z

Link: CVE-2026-16017

cve-icon Vulnrichment

Updated: 2026-07-17T17:27:21.606Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T08:30:03Z

Weaknesses