CVE-2026-16195

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16195", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-18T07:22:29.086Z", "datePublished": "2026-07-18T22:30:10.281Z", "dateUpdated": "2026-07-20T13:25:11.446Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T22:30:10.281Z"}, "title": "Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "Incorrect Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "Sipeed", "product": "PicoClaw", "versions": [{"version": "0.2.0", "status": "affected"}, {"version": "0.2.1", "status": "affected"}, {"version": "0.2.2", "status": "affected"}, {"version": "0.2.3", "status": "affected"}, {"version": "0.2.4", "status": "affected"}, {"version": "0.2.5", "status": "affected"}, {"version": "0.2.6", "status": "affected"}, {"version": "0.2.7", "status": "affected"}, {"version": "0.2.8", "status": "affected"}, {"version": "0.2.9", "status": "affected"}], "cpes": ["cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"], "modules": ["Group Message Handler"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-18T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-18T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-18T09:27:47.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-i (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/380011", "name": "VDB-380011 | Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/380011/cti", "name": "VDB-380011 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16195", "name": "CVE-2026-16195 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/852962", "name": "Submit #852962 | Sipeed PicoClaw <= 0.2.9 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sipeed/picoclaw/issues/3076", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/sipeed/picoclaw/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T13:25:04.519225Z", "id": "CVE-2026-16195", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:25:11.446Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16195", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T13:25:04.519225Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:25:08.191Z"}}], "cna": {"title": "Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-i (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"], "vendor": "Sipeed", "modules": ["Group Message Handler"], "product": "PicoClaw", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3"}, {"status": "affected", "version": "0.2.4"}, {"status": "affected", "version": "0.2.5"}, {"status": "affected", "version": "0.2.6"}, {"status": "affected", "version": "0.2.7"}, {"status": "affected", "version": "0.2.8"}, {"status": "affected", "version": "0.2.9"}]}], "timeline": [{"lang": "en", "time": "2026-07-18T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-18T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-18T09:27:47.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/380011", "name": "VDB-380011 | Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/380011/cti", "name": "VDB-380011 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16195", "name": "CVE-2026-16195 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/852962", "name": "Submit #852962 | Sipeed PicoClaw <= 0.2.9 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sipeed/picoclaw/issues/3076", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/sipeed/picoclaw/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T22:30:10.281Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16195", "state": "PUBLISHED", "dateUpdated": "2026-07-20T13:25:11.446Z", "dateReserved": "2026-07-18T07:22:29.086Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-18T22:30:10.281Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"], "modules": ["Group Message Handler"], "product": "PicoClaw", "vendor": "Sipeed", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3"}, {"status": "affected", "version": "0.2.4"}, {"status": "affected", "version": "0.2.5"}, {"status": "affected", "version": "0.2.6"}, {"status": "affected", "version": "0.2.7"}, {"status": "affected", "version": "0.2.8"}, {"status": "affected", "version": "0.2.9"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity."}, {"lang": "es", "value": "Se ha descubierto un fallo de seguridad en Sipeed PicoClaw hasta la versi\u00f3n 0.2.9. Este problema afecta a la funci\u00f3n dispatchIncoming del archivo pkg/channels/wecom/wecom.go del componente Gestor de Mensajes de Grupo. La manipulaci\u00f3n resulta en una autorizaci\u00f3n incorrecta. Es posible lanzar el ataque de forma remota. El exploit ha sido publicado y puede ser utilizado para ataques. La incidencia de GitHub reportada fue cerrada autom\u00e1ticamente debido a la inactividad."}], "id": "CVE-2026-16195", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16195", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T13:25:04.519225Z", "version": "2.0.3"}}]}, "published": "2026-07-18T23:17:00.847", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/sipeed/picoclaw/"}, {"source": "cna@vuldb.com", "url": "https://github.com/sipeed/picoclaw/issues/3076"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-16195"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/852962"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/380011"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/380011/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-863"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.9"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PicoClaw", "source": "cna", "vendor": "Sipeed"}, "product": "picoclaw", "vendor": "sipeed"}], "created": "2026-07-21T12:00:05.505710+00:00", "title": "Improper authorization in Sipeed PicoClaw Group Message Handler", "updated": "2026-07-30T23:00:22.296068+00:00", "vendors": ["sipeed", "sipeed$PRODUCT$picoclaw"]}