CVE-2026-17531

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-17531

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17531.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-17531

Published

2026-07-27T16:15:09.448Z

Modified

2026-07-29T03:46:03.626739508Z

Severity

1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

Details

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17531.json",
    "cwe_ids": [
        "CWE-285",
        "CWE-639"
    ]
}

References

Affected packages

Git / github.com/unitedbyai/droidclaw

Affected ranges

Type

GIT

Repo

https://github.com/unitedbyai/droidclaw

Events

Introduced

7c271732c40c0281395359e48c1f6d5f22988d56

Last affected

df489456956fcc3338e2c114344a3cf66946cf25

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.5.0"
        },
        {
            "last_affected": "0.5.0"
        },
        {
            "introduced": "0.5.1"
        },
        {
            "last_affected": "0.5.1"
        },
        {
            "introduced": "0.5.2"
        },
        {
            "last_affected": "0.5.2"
        },
        {
            "introduced": "0.5.3"
        },
        {
            "last_affected": "0.5.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.5.0

0.5.1

0.5.2

0.5.3

v0.*

v0.5.0

v0.5.1

v0.5.2

v0.5.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17531.json"