CVE-2026-14716 | A security vulnerability has been detected in nextlevelbuild… | CVSS 6.3 MEDIUM

Description

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads to incorrect authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report.

Metadata

CVE ID: CVE-2026-14716
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-04 07:50 UTC
Published: 2026-07-05 05:45 UTC
Last updated: 2026-07-05 05:45 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: nextlevelbuilder / GoClaw
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
nextlevelbuilder	GoClaw	—	3.13.0-beta.0, 3.13.0-beta.1, 3.13.0-beta.2

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	Improper Authorization
CWE-863	cna	Incorrect Authorization

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-376305 | nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization https://vuldb.com/vuln/376305
VDB-376305 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/376305/cti
CVE-2026-14716 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-14716
Submit #847501 | NextLevelBuilder GoClaw 3.13.0-beta.2 Incorrect Authorization (CWE-863) https://vuldb.com/submit/847501
https://github.com/nextlevelbuilder/goclaw/issues/1188
https://github.com/nextlevelbuilder/goclaw/