CVE-2026-15622

MEDIUM 5.3

poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument user_id can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Upgrading the affected component is recommended.

CWE	CWE-639 CWE-285
Vendor	poco-ai
Product	poco-claw
Published	Jul 14, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for poco-ai poco-claw

Be the first to know when new medium vulnerabilities affecting poco-ai poco-claw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

poco-ai / poco-claw

0.5.0 0.5.1 0.5.2 0.5.3 0.5.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/378125 vuldb.com: https://vuldb.com/vuln/378125/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15622 vuldb.com: https://vuldb.com/submit/855797 github.com: https://github.com/poco-ai/poco-claw/issues/133 github.com: https://github.com/poco-ai/poco-claw/pull/135 github.com: https://github.com/poco-ai/poco-claw/commit/67fcc88505c57f77d3fcf04eb5b89425b10cbf48 github.com: https://github.com/poco-ai/poco-claw/

Credits

🔍 Eric-b (VulDB User)