CVE-2026-16075— AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AstrBotDevs | AstrBot | 4.25.0 | affected |
4.25.1 | affected | ||
4.25.2 | affected | ||
4.25.3 | affected | ||
4.25.4 | affected | ||
4.25.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16075
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/open_api.py of the component session-listing Endpoint. This manipulation of the argument Username causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AstrBotDevs | AstrBot | 4.25.0 | cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-16075
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16075
请登录查看更多情报信息。
Proof of Concept for CVE-2026-16075 (1)
Same Patch Batch · AstrBotDevs · 2026-07-18 · 3 CVEs total
| CVE-2026-16076 | 6.3 MEDIUM | AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing |
| CVE-2026-16077 | 5.3 MEDIUM | AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following |
IV. Related Vulnerabilities
Same product: AstrBot
- CVE-2026-16077
AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _norm - CVE-2026-16076
AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send a - CVE-2026-16074
AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugi - CVE-2026-16073
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrateg - CVE-2026-15501
AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.te
Same vendor: AstrBotDevs
- CVE-2026-16077
AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _norm - CVE-2026-16076
AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send a - CVE-2026-16074
AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugi - CVE-2026-16073
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrateg - CVE-2026-15501
AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.te
Same weakness: CWE-639
- CVE-2026-16217
guohongze adminset Delivery Deployment Endpoint deli.py auth - CVE-2026-16214
geex-arts django-jet Dashboard views.py authorization - CVE-2026-55518
Avo: Missing Authorization in Avo Association Attach Endpoin - CVE-2026-13445
Langflow is affected by remote code execution, denial of ser - CVE-2026-48016
Shopware: Unauthorized Payment Trigger for Foreign Orders vi
V. Comments for CVE-2026-16075
No comments yet