CVE-2026-15500
AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 12, 2026
- Updated
- Jul 13, 2026
- Reserved
- Jul 11, 2026
Description
A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashboard/routes/plugin.py of the component market_list Endpoint. Executing a manipulation of the argument custom_registry can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
AstrBotAstrBotDevs |
|
References
- VDB-377807 | AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgeryvdb-entrytechnical-description
- VDB-377807 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-15500 | CVE Analysis and Reportthird-party-advisory
- Submit #844659 | AstrBotDevs AstrBot 4.25.2 Server-Side Request Forgery (CWE-918)third-party-advisory
- Submit #847481 | AstrBotDevs AstrBot 4.25.2 Server-Side Request Forgery (SSRF) (CWE-918) (Duplicate)third-party-advisory
- https://gist.github.com/YLChen-007/cd162554554c273a3a7c0330aa02f3f0exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.