EUVD-2026-45353
GHSA-p8fw-8mf8-rwq8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring low-privilege authentication; only confidentiality impacted with no scope change or integrity/availability effects.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/open_api.py of the component session-listing Endpoint. This manipulation of the argument Username causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat sessions belonging to other users by manipulating the Username parameter in the session-listing endpoint, affecting all versions up to and including 4.25.5. The vulnerable function OpenApiRoute.get_chat_sessions in astrbot/dashboard/routes/open_api.py fails to verify that the requesting user is authorized to access the target Username's session data (CWE-639 IDOR). A public proof-of-concept exploit exists on GitHub; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the low attack complexity and published POC materially lower the exploitation barrier.
Technical ContextAI
AstrBot is a Python-based AI chatbot dashboard framework by AstrBotDevs. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of Insecure Direct Object Reference (IDOR) flaws where the application uses an attacker-supplied value - here the Username argument - as a direct lookup key to retrieve session records without enforcing that the authenticated requester owns or is permitted to view that resource. The vulnerable code path is OpenApiRoute.get_chat_sessions in astrbot/dashboard/routes/open_api.py, part of the dashboard's open API route layer. The affected CPE is cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:*, with no lower version bound specified, implying all prior releases share the same flaw. The CVSS 4.0 vector supplied includes E:P (proof-of-concept exploit exists), consistent with the published GitHub Gist POC.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure attempt. As the most impactful immediate compensating control, restrict access to the AstrBot dashboard interface to trusted internal networks or VPN-only environments, preventing remote low-privileged users from reaching the vulnerable endpoint (trade-off: reduces operational accessibility for remote users). Operators should audit and minimize the number of accounts with dashboard access, as exploitation requires prior authentication. If source-code modification is feasible, apply a server-side authorization check in OpenApiRoute.get_chat_sessions to assert that the authenticated session's user identity matches the requested Username before returning any data. Monitor the VulDB advisory at https://vuldb.com/vuln/379790 and the AstrBotDevs repository for any upstream fix commits. The public exploit POC is at https://gist.github.com/YLChen-007/5fee3adfd95333b0f4eff8165af61f81 and can be used to verify whether a remediation is effective.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today