CVE-2026-10217

A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the component RoleAdmin Gateway. This manipulation causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project tagged the reported issue as bug.

CVSS v3 6.3 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/nextlevelbuilder/goclaw/
https://github.com/nextlevelbuilder/goclaw/issues/1118
https://vuldb.com/cve/CVE-2026-10217
https://vuldb.com/submit/821937
https://vuldb.com/vuln/367496
https://vuldb.com/vuln/367496/cti

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Se ha encontrado una falla en nextlevelbuilder GoClaw hasta la versión 3.11.3. El elemento afectado es la función handleSave del archivo internal/HTTP/tts_config.go del componente RoleAdmin Gateway. Esta manipulación provoca una gestión de privilegios inadecuada. La explotación remota del ataque es posible. El exploit ha sido publicado y puede ser utilizado. El proyecto etiquetó la incidencia reportada como bug.

01 Jun 2026, 04:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 04:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-10217

Mitre link : CVE-2026-10217

CVE.ORG link : CVE-2026-10217

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

CWE-269

Improper Privilege Management

{"id": "CVE-2026-10217", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10217", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T14:57:20.900067Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*"], "vendor": "nextlevelbuilder", "modules": ["RoleAdmin Gateway"], "product": "GoClaw", "versions": [{"status": "affected", "version": "3.11.0"}, {"status": "affected", "version": "3.11.1"}, {"status": "affected", "version": "3.11.2"}, {"status": "affected", "version": "3.11.3"}]}]}], "published": "2026-06-01T04:16:20.680", "references": [{"url": "https://github.com/nextlevelbuilder/goclaw/", "source": "cna@vuldb.com"}, {"url": "https://github.com/nextlevelbuilder/goclaw/issues/1118", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-10217", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/821937", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/367496", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/367496/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/tts_config.go of the component RoleAdmin Gateway. This manipulation causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project tagged the reported issue as bug."}, {"lang": "es", "value": "Se ha encontrado una falla en nextlevelbuilder GoClaw hasta la versi\u00f3n 3.11.3. El elemento afectado es la funci\u00f3n handleSave del archivo internal/HTTP/tts_config.go del componente RoleAdmin Gateway. Esta manipulaci\u00f3n provoca una gesti\u00f3n de privilegios inadecuada. La explotaci\u00f3n remota del ataque es posible. El exploit ha sido publicado y puede ser utilizado. El proyecto etiquet\u00f3 la incidencia reportada como bug."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "cna@vuldb.com"}