CVE-2026-32231

Katalog CVE

CVSS 8.2 · High EPSS 0,26%

Kerentanan Missing Authentication for Critical Function pada zeptoclaw. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6.

Rincian

Terbit di NVD

12 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-46q5-g3j9-wx5c exploit · advisory vendor
• https://github.com/qhkm/zeptoclaw/commit/bf004a20d3687a0c1a9e052ec79536e30d6de134 patch
• https://github.com/qhkm/zeptoclaw/pull/324 issue tracking · patch
• https://github.com/qhkm/zeptoclaw/releases/tag/v0.7.6 patch · release notes