The Sipeed PicoClaw component includes a Group Message Handler that dispatches messages via a function in the wecom.go file. An authorization logic flaw allows a remote attacker to trigger the dispatchIncoming endpoint without proper privileges. This breach is classified as CWE-285 Improper Authorization and CWE-863 Authorization Bypass, permitting users to send or manipulate group messages they should not be able to access, resulting in potential impersonation or unapproved message dissemination.

Sipeed PicoClaw versions up to 0.2.9, including earlier releases, contain this flaw. No information is available in the CVE data about whether newer releases are vulnerable, so all affected versions are those equal to or older than 0.2.9.

The CVSS score of 5.3 denotes moderate severity. The EPSS score of less than 1% suggests that the probability of exploitation is currently low, yet publicly available exploits indicate that an attacker could leverage the flaw. The vulnerability is not listed in CISA's KEV catalog. Likely, an adversary can target the system over the network, issuing the dispatchIncoming request from a remote host; failure of the authorization check would then allow unauthorized message dispatch with no additional privileges.