CVE-2026-15622

Name of the Vulnerable Software and Affected Versions poco-ai poco-claw versions prior to 0.5.5

Description A flaw in the Workspace API component allows a remote attacker to bypass authorization. The issue exists in the get workspace file() function within the file executor manager/app/api/v1/workspace.py. By manipulating the user id variable, an attacker can gain unauthorized access.

Recommendations Update poco-ai poco-claw to version 0.5.5 or later. As a temporary mitigation, restrict access to the user id parameter in the affected API endpoint.