CVE-2026-15499

MEDIUM

AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization

Title source: cna

Description

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload["note"] results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-377806 | AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization

https://vuldb.com/vuln/377806

Signature, Permissions Required signature permissions-required

VDB-377806 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/377806/cti

Third Party Advisory third-party-advisory

CVE-2026-15499 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-15499

Third Party Advisory third-party-advisory

Submit #844656 | AstrBotDevs AstrBot 4.25.2 Improper Authorization (CWE-285)

https://vuldb.com/submit/844656

Exploit exploit

https://gist.github.com/YLChen-007/2bab96d5bedef784f90c97009fff8a19

Scores

CVSS v3 6.3

EPSS 0.0020

EPSS Percentile 10.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-266 CWE-285

Status published

Products (3)

AstrBotDevs/AstrBot 4.25.0

AstrBotDevs/AstrBot 4.25.1

AstrBotDevs/AstrBot 4.25.2

Published Jul 12, 2026

Tracked Since Jul 12, 2026