CVE-2026-16075: 
AstrBot vulnerability analysis and mitigation

CVE-2026-16075 is an authorization bypass vulnerability in AstrBotDevs AstrBot affecting versions 4.25.0 through 4.25.5. The flaw resides in the OpenApiRoute.get_chat_sessions() function within astrbot/dashboard/routes/open_api.py, where the username query parameter is trusted without binding it to the authenticated API key principal, allowing any authenticated user to enumerate other users' WebChat sessions. It was disclosed on July 18, 2026, with a public proof-of-concept published prior to vendor response. The CVE carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, VulDB).

The root cause is classified as CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). The authentication middleware in astrbot/dashboard/server.py correctly validates the API key and enforces scope, setting the server-side principal as g.username = f"api_key:{api_key.key_id}". However, the downstream get_chat_sessions() function ignores this server-derived identity and instead passes the caller-supplied request.args.get("username") directly to get_platform_sessions_by_creator_paginated(), making the authorization subject fully attacker-controlled. Exploitation requires only a valid chat-scope API key and knowledge (or guessing) of a victim's username; no elevated privileges are needed beyond basic authenticated access (PoC Gist, GitHub Advisory).

Successful exploitation allows any authenticated OpenAPI client holding a chat-scope API key to enumerate WebChat sessions belonging to arbitrary other users by supplying their username in the query parameter. Exposed data includes session identifiers, platform identifiers, creator names, display names, and session creation/update timestamps. While there is no integrity or availability impact, the information disclosure breaks session ownership isolation and provides a reliable starting point for follow-on attacks against endpoints that accept session_id, username, or related routing identities as input — particularly relevant in multi-user or shared AstrBot deployments (PoC Gist).

A public proof-of-concept was published by researcher YLChen-007 on GitHub Gist (created June 9, 2026, disclosed July 18, 2026), demonstrating end-to-end exploitation including session creation and cross-user enumeration via a simple curl command. The NVD SSVC assessment classifies exploitation status as "poc" and notes the attack is not automatable. The EPSS score is approximately 0.218% (12th percentile), indicating low but non-zero probability of near-term exploitation. There is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (GitHub Advisory, VulDB).

1. Obtain a chat-scope API key: Log into the AstrBot dashboard and create an OpenAPI key with chat scope via POST /api/apikey/create, or obtain one through other means (e.g., social engineering or credential reuse).
2. Identify target username: Determine a victim's username through reconnaissance — usernames may be guessable (e.g., dashboard-admin) or discoverable through other API responses.
3. Craft the malicious request: Send a GET request to the session-listing endpoint with the victim's username substituted in the query parameter:

   curl 'http://<target>:6185/api/v1/chat/sessions?username=<victim-username>&page=1&page_size=20&platform_id=webchat' -H 'X-API-Key: <your-chat-scope-key>'

4. Retrieve victim session data: The server returns session metadata (session IDs, platform IDs, creator names, timestamps) belonging to the victim user, bypassing ownership isolation.
5. Leverage session identifiers: Use the harvested session_id values as input to other AstrBot endpoints that accept session or user identity parameters for further reconnaissance or follow-on attacks (PoC Gist).

• Network: Repeated GET requests to /api/v1/chat/sessions with varying username query parameter values not matching the authenticated API key's principal; requests originating from a single API key querying multiple distinct usernames in a short timeframe.
• Logs: AstrBot access logs showing GET /api/v1/chat/sessions?username=<other-user> with a valid X-API-Key header where the username does not correspond to the key owner; HTTP 200 responses to such requests indicating successful data retrieval.
• Application Behavior: A single chat-scope API key issuing session-listing queries for usernames other than its own registered identity (e.g., api_key:<key_id>) — detectable by correlating g.username set by middleware against the username parameter in the request (PoC Gist).

Update AstrBot to a version newer than 4.25.5, which addresses the authorization bypass by binding the session query to the authenticated API key principal rather than the caller-supplied username parameter. If immediate patching is not possible, implement network-level access controls to restrict access to the /api/v1/chat/sessions endpoint to trusted clients only. As an application-level workaround, add authorization logic to get_chat_sessions() to enforce that the username parameter matches g.username (the server-derived API key identity) before executing the database query (GitHub Advisory, PoC Gist).

The vulnerability was reported by researcher YLChen-007, who published a detailed proof-of-concept gist on June 9, 2026, and submitted the disclosure through VulDB. The advisory notes that the vendor (AstrBotDevs) was contacted early but did not respond in any way prior to public disclosure. No significant broader media coverage or notable community commentary beyond the initial disclosure has been identified (GitHub Advisory, VulDB).