CVE-2026-16075 Overview
CVE-2026-16075 is an authorization bypass vulnerability in AstrBotDevs AstrBot versions up to 4.25.5. The flaw resides in the OpenApiRoute.get_chat_sessions function within astrbot/dashboard/routes/open_api.py, which handles the session-listing endpoint. Attackers can manipulate the Username argument to bypass authorization controls and enumerate chat sessions belonging to other users. The issue is classified under [CWE-285] Improper Authorization and can be exploited remotely over the network by an authenticated low-privilege user. According to the disclosure, a working exploit has been published, and the vendor did not respond to early disclosure attempts.
Critical Impact
An authenticated attacker with low privileges can bypass authorization checks in the session-listing API to access chat session data belonging to other AstrBot users.
Affected Products
- AstrBotDevs AstrBot versions up to and including 4.25.5
- Component: astrbot/dashboard/routes/open_api.py (session-listing endpoint)
- Function: OpenApiRoute.get_chat_sessions
Discovery Timeline
- 2026-07-18 - CVE CVE-2026-16075 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-16075
Vulnerability Analysis
The vulnerability is an improper authorization flaw in the AstrBot dashboard Open API. The get_chat_sessions handler in OpenApiRoute accepts a Username argument from the request and returns session data associated with that user. The handler does not verify that the authenticated caller is authorized to view sessions belonging to the supplied Username. An attacker with a valid low-privilege account can substitute another user's identifier and retrieve their chat session metadata. The exploit prediction score (EPSS) currently sits at 0.218%, indicating limited but non-zero attacker interest.
Root Cause
The root cause is missing object-level access control in OpenApiRoute.get_chat_sessions. The endpoint trusts the client-supplied Username parameter without cross-checking it against the session token or authenticated principal. This pattern is a textbook Broken Object Level Authorization (BOLA) issue mapped to [CWE-285].
Attack Vector
Exploitation requires network access to the AstrBot dashboard API and valid low-privilege credentials. The attacker sends a request to the session-listing endpoint while setting the Username parameter to a target account. The server returns session data for that account without validating the caller's authorization. No user interaction is required, and no elevated privileges are needed. Technical details and a proof-of-concept are published in a GitHub Gist resource and the VulDB CVE-2026-16075 entry.
Detection Methods for CVE-2026-16075
Indicators of Compromise
- Unusual request volume against the /get_chat_sessions Open API route with varying Username values from a single session token.
- API access logs showing a single authenticated principal querying multiple distinct Username parameters in short succession.
- Requests where the Username parameter does not match the authenticated caller's identity in the session or token.
Detection Strategies
- Enable verbose logging on the AstrBot dashboard and correlate the authenticated user identity with the Username parameter submitted to OpenApiRoute.get_chat_sessions.
- Deploy a web application firewall rule that flags or blocks requests to the session-listing endpoint when the parameter value diverges from the session owner.
- Baseline normal API usage patterns and alert on anomalous enumeration of user identifiers against a single endpoint.
Monitoring Recommendations
- Forward AstrBot dashboard access logs to a centralized SIEM for retention and correlation.
- Monitor for repeated 200-status responses to get_chat_sessions calls that reference multiple distinct usernames from one source IP or token.
- Track new low-privilege account creation followed by rapid Open API queries, which may indicate reconnaissance.
How to Mitigate CVE-2026-16075
Immediate Actions Required
- Restrict network exposure of the AstrBot dashboard so that only trusted networks can reach the Open API routes.
- Rotate credentials and API tokens for any AstrBot instance running version 4.25.5 or earlier.
- Audit historical access logs for the get_chat_sessions endpoint to identify past enumeration attempts.
Patch Information
At the time of publication, no vendor patch has been referenced in the NVD entry, and the vendor did not respond to disclosure attempts. Monitor the AstrBot project repository for a fix beyond version 4.25.5 and consult the VulDB vulnerability record #379790 for updates.
Workarounds
- Place the AstrBot dashboard behind a reverse proxy that enforces per-user authorization on the /get_chat_sessions route before forwarding requests.
- Disable the Open API session-listing endpoint if it is not required for operational workflows.
- Apply a local code patch to OpenApiRoute.get_chat_sessions that compares the request Username argument against the authenticated principal and rejects mismatches with HTTP 403.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
