CVE-2026-16075

MEDIUM

AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization

Title source: cna

Description

A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/open_api.py of the component session-listing Endpoint. This manipulation of the argument Username causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-379790 | AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization

https://vuldb.com/vuln/379790

Signature, Permissions Required signature permissions-required

VDB-379790 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/379790/cti

Third Party Advisory third-party-advisory

CVE-2026-16075 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-16075

Third Party Advisory third-party-advisory

Submit #852863 | AstrBotDevs AstrBot <= 4.25.5 Authorization Bypass Through User-Controlled Key (CWE-639)

https://vuldb.com/submit/852863

Exploit exploit

https://gist.github.com/YLChen-007/5fee3adfd95333b0f4eff8165af61f81

Scores

CVSS v3 4.3

EPSS 0.0022

EPSS Percentile 12.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-285 CWE-639

Status published

Products (6)

AstrBotDevs/AstrBot 4.25.0

AstrBotDevs/AstrBot 4.25.1

AstrBotDevs/AstrBot 4.25.2

AstrBotDevs/AstrBot 4.25.3

AstrBotDevs/AstrBot 4.25.4

AstrBotDevs/AstrBot 4.25.5

Published Jul 18, 2026

Tracked Since Jul 18, 2026