| Titre | nextlevelbuilder goclaw <= v3.11.3 Improper Authorization (CWE-285) |
|---|
| Description | # Technical Details
An Evolution Suggestion Authorization Bypass exists in the `PATCH /v1/agents/{agentID}/evolution/suggestions/{suggestionID}` endpoint in `internal/http/evolution_handlers.go` of goclaw.
The application fails to set an explicit role requirement in the access control middleware, using `requireAuth("", next)` which dynamically resolves to `RoleOperator` for PATCH. Gateway Tokens forcibly elevate users to `RoleAdmin` for the request context, bypassing this check. Furthermore, the endpoint lacks tenant-level admin verification checks, allowing unauthenticated or low-privilege users (e.g., Viewers) to approve, reject, or modify system-generated Evolution Suggestions.
# Vulnerable Code
File: internal/http/evolution_handlers.go
Method: auth
Why: The handler incorrectly sets an empty minimum role `requireAuth("", next)`, which auto-resolves to the weak `RoleOperator` for the HTTP PATCH method and gets bypassed by gateway tokens without secondary tenant checks.
# Reproduction
1. Start up the GoClaw environment with the standard Gateway Token mechanism.
2. Ensure there is a pending system-generated evolution suggestion in the database (e.g., `tool_order` suggestion).
3. Issue a `PATCH` HTTP request against the endpoint using a low privilege (Viewer) identity.
4. Observe that the low privilege identity successfully approves or rejects the suggestion.
# Impact
- Administrative Privilege Escalation via the Gateway Token dynamic role assumption gap.
- Attackers with only `Viewer` permissions can deny important structural configuration tuning requests, apply untested threshold changes, or forcefully disable Built-in capability tools, causing significant functional degradations (Denial of Service) globally for all users. |
|---|
| La source | ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1120 |
|---|
| Utilisateur | Eric-b (UID 96354) |
|---|
| Soumission | 07/05/2026 13:51 (il y a 28 jours) |
|---|
| Modérer | 31/05/2026 09:41 (24 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 367497 [nextlevelbuilder GoClaw jusqu’à 3.11.3 evolution_handlers.go auth élévation de privilèges] |
|---|
| Points | 20 |
|---|