Low
Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization
Type: advisorySources: OSV
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically due to inactivity.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-16197
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 10:13 UTC · Revision 1
Source evidence
Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization
core-osv · Original sourcePublished 18 Jul 2026, 23:00 UTC
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically due to inactivity.
osv:CVE-2026-16197
Complete source record
{
"id": "3ccdedf1b4b6bc9d9d42cb518446318e27ebb28abe870726c839771ce374a55e",
"url": "https://osv.dev/vulnerability/CVE-2026-16197",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization",
"summary": "A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically due to inactivity.",
"evidence": "osv:CVE-2026-16197",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-16197",
"aliases": [
"CVE-2026-16197"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sipeed/picoclaw",
"type": "GIT",
"events": [
{
"introduced": "8207c1c7e6006c0664dfec99fd6bbbda34d2550a"
},
{
"last_affected": "2992eccbf03e54258a6889cf19a5a4fe6255895f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.2.0"
},
{
"last_affected": "0.2.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.1"
},
{
"last_affected": "0.2.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.2"
},
{
"last_affected": "0.2.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.3"
},
{
"last_affected": "0.2.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.4"
},
{
"last_affected": "0.2.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.5"
},
{
"last_affected": "0.2.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.6"
},
{
"last_affected": "0.2.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.7"
},
{
"last_affected": "0.2.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.8"
},
{
"last_affected": "0.2.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.9"
},
{
"last_affected": "0.2.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.2.9"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"0.2.0",
"0.2.1",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9",
"v0.2.9",
"v0.2.8",
"v0.2.7",
"v0.2.6",
"v0.2.5",
"v0.2.4",
"v0.2.3",
"v0.2.2",
"v0.2.2-nightly.20260312.6612ca09",
"v0.2.1",
"v0.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16197.json"
}
}
],
"modified": "2026-10-28T02:30:50.293887352Z",
"provider": "osv",
"references": [
"https://github.com/sipeed/picoclaw/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16197.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-16197",
"https://vuldb.com/cve/CVE-2026-16197",
"https://vuldb.com/submit/852964",
"https://vuldb.com/vuln/380013",
"https://github.com/sipeed/picoclaw/issues/3082",
"https://vuldb.com/vuln/380013/cti"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16197.json"
}
},
"related_cves": [
{
"value": "CVE-2026-16197",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518973,
"published_at": "2026-07-18T23:00:12.202+00:00"
}