CVE-2026-16195CWE-285CWE-863broken-access-control

CVE-2026-16195

Medium · published July 19, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00366 · 29.3th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-863 · Incorrect Authorization
Published
2026-07-19T03:17Z
References (6)
https://vuldb.com/submit/852962 · [email protected]https://vuldb.com/vuln/380011 · [email protected]https://vuldb.com/vuln/380011/cti · [email protected]https://github.com/sipeed/picoclaw/ · [email protected]https://github.com/sipeed/picoclaw/issues/3076 · [email protected]https://vuldb.com/cve/CVE-2026-16195 · [email protected]
EPSS history
Timeline
  • 18 JUL 22:30Z
    Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization
    cvelistv5