CVE-2026-15622

Medium

Description

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument user_id can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Upgrading the affected component is recommended.

SeverityMedium

CVSS5.3

Exploit probability—

ProductPoco-ai Poco-claw

PublishedJul 14, 2026

First seenJul 14, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key CWE-285CWE-285

How to fix

Patches

Affected products

Product	Affected versions	Fixed in
poco-ai poco-claw	0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.