CVE-2026-56402
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jun 23, 2026
Vendor
unknown
Description
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation.