CVE-2026-16197

MEDIUM

Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically due to inactivity.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-380013 | Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization
https://vuldb.com/vuln/380013
Signature, Permissions Required signature permissions-required
VDB-380013 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/380013/cti
Third Party Advisory third-party-advisory
CVE-2026-16197 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16197
Third Party Advisory third-party-advisory
Submit #852964 | Sipeed PicoClaw <= v0.2.9 Missing Authorization (CWE-862)
https://vuldb.com/submit/852964
Exploit exploit issue-tracking
https://github.com/sipeed/picoclaw/issues/3082

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 11.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-862 CWE-863
Status published
Products (10)
Sipeed/PicoClaw 0.2.0
Sipeed/PicoClaw 0.2.1
Sipeed/PicoClaw 0.2.2
Sipeed/PicoClaw 0.2.3
Sipeed/PicoClaw 0.2.4
Sipeed/PicoClaw 0.2.5
Sipeed/PicoClaw 0.2.6
Sipeed/PicoClaw 0.2.7
Sipeed/PicoClaw 0.2.8
Sipeed/PicoClaw 0.2.9
Published Jul 18, 2026
Tracked Since Jul 19, 2026