PT-2026-45244 · Astrbotdevs · Astrbot

Eric-A · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-10212

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBotDevs AstrBot version 4.24.2

Description An authorization bypass exists that can be triggered remotely. The issue occurs within the astr main agent() function located in the astrbot/core/astr main agent.py file, where manipulation of the session id argument allows an attacker to bypass security checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the astr main agent() function or monitor the session id argument for suspicious manipulation.

Exploit

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-10212

Affected Products

Astrbot

References · 9

• 🔥 https://gist.github.com/YLChen-007/91a7f955143099e1747424707dfad0f9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10212 · Security Note
• https://t.me/cveNotify/165404 · Telegram Post
• https://t.me/CVEtracker/55414 · Telegram Post
• https://vuldb.com/submit/821923 · Note
• https://twitter.com/VulmonFeeds/status/2061306489596203139 · Twitter Post
• https://vuldb.com/cve/CVE-2026-10212 · Note
• https://vuldb.com/vuln/367491 · Note
• https://vuldb.com/vuln/367491/cti · Note