CVE-2026-16195 | A security flaw has been discovered in Sipeed PicoClaw up to… | CVSS 6.3 MEDIUM

Description

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Metadata

CVE ID: CVE-2026-16195
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-18 07:22 UTC
Published: 2026-07-18 22:30 UTC
Last updated: 2026-07-18 22:30 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: Sipeed / PicoClaw
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
Sipeed	PicoClaw	—	0.2.0, 0.2.1, 0.2.2, 0.2.3 …

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	Improper Authorization
CWE-863	cna	Incorrect Authorization

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-380011 | Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization https://vuldb.com/vuln/380011
VDB-380011 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/380011/cti
CVE-2026-16195 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-16195
Submit #852962 | Sipeed PicoClaw <= 0.2.9 Incorrect Authorization (CWE-863) https://vuldb.com/submit/852962
https://github.com/sipeed/picoclaw/issues/3076
https://github.com/sipeed/picoclaw/