EUVD-2026-49322
GHSA-v5vq-g74q-p374
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated access needed (PR:L) but no user interaction; remote network attack with low complexity.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is d23011262e8e75e1ec41b0f1f0091493a022327e. It is suggested to install a patch to address this issue.
AnalysisAI
Incorrect authorization in AstrBot up to 4.25.5 allows remote authenticated users to bypass persona-based tool restrictions and execute unauthorized function tools. A public exploit exists, and a patch is available from the vendor. No active exploitation has been reported via CISA KEV, but the public exploit increases risk for deployments using persona tool controls.
Technical ContextAI
AstrBot is an AI agent framework that supports persona-based tool restrictions, where each persona defines a set of allowed tools. The vulnerability resides in the authorization logic within astr_main_agent.py and astr_agent_tool_exec.py. The affected function _decorate_llm_request and _ensure_persona_and_skills failed to filter the req.func_tool.tools list based on the persona's allowed tools, leading to incorrect authorization (CWE-863). The patch adds proper filtering by passing persona_allowed_tools through the call chain and using it to restrict the tool set. The CPE cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:* indicates all versions of AstrBot are potentially affected.
RemediationAI
Apply the vendor-released patch by updating to a version that includes commit d23011262e8e75e1ec41b0f1f0091493a022327e, available via GitHub pull request #8786. Administrators should upgrade their AstrBot instance to the fixed version as soon as possible. If immediate patching is not feasible, consider restricting network access to the AstrBot service to trusted users only, as exploitation requires a valid authenticated session. No other workarounds are documented.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today