The weakness in GoClaw’s matchesAllowlist function allows a client to request approval for actions that should not be authorized, effectively bypassing the intended access control. This leads to a privilege escalation scenario where unauthorized operations can be performed, potentially compromising confidentiality, integrity, or availability of protected resources. The flaw is identified as a failure in authorization and access control, linked to the CWE-285 and CWE-863 categories.

Vendors affected: nextlevelbuilder:GoClaw, with all releases up to and including version 3.13.2. The vulnerability originates in internal/tools/exec_approval.go and impacts the RequestApproval/matchesAllowlist functionality within the GoClaw codebase.

The CVSS score of 4.8 places this flaw in a low‑to‑medium severity range, while the EPSS score of <1% indicates a low likelihood of real‑world exploitation currently. Based on the description, it is inferred that the likely attack vector is remote network interaction with the approval workflow. Because the flaw allows remote authorization bypass without requiring elevated local privileges, an attacker with network access could potentially trigger unauthorized approvals if the affected functionality is exposed to untrusted users. This vulnerability is not listed in the CISA KEV catalog, but the public release of an exploit raises the potential for future attacks, especially if the approval workflow is accessible over the network or through APIs.