CVE-2026-7505
Published: 30 April 2026
Summary
CVE-2026-7505 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-7505 is an improper authorization vulnerability (CWE-266, CWE-285) in an unknown function of the RPC Handler component within nextlevelbuilder GoClaw and GoClaw Lite versions up to 3.8.5. The issue allows manipulation that bypasses authorization controls, earning a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability, such as limited unauthorized access or modification.
Advisories recommend upgrading to version 3.9.0, which includes the fixing commit 406022e79f4a18b3070a446712080571eff11e30. Relevant GitHub resources detail the issue in #866, the pull request in #950, and the release at v3.9.0.
An exploit for this vulnerability has been published and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26453
Vulnerability details
A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been published…
more
and may be used. Upgrading to version 3.9.0 mitigates this issue. Patch name: 406022e79f4a18b3070a446712080571eff11e30. You should upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote improper authorization vulnerability in a public-facing RPC Handler component allowing unauthenticated attackers to bypass controls over the network, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the improper authorization flaw in the RPC handler by identifying, reporting, and applying the specific patch to version 3.9.0.
Enforces approved authorizations for access to system resources, preventing remote unauthorized manipulation via the flawed RPC handler function.
Limits damage from authorization bypass by ensuring only least privileges are granted to processes handling RPC requests.