CVE-2026-17529

AstrBotDevs AstrBot astr_main_agent.py authorization

State: Published
Severity: 5.3 Medium
Published: Jul 27, 2026
Updated: Jul 27, 2026
Reserved: Jul 27, 2026

Description

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is d23011262e8e75e1ec41b0f1f0091493a022327e. It is suggested to install a patch to address this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-863 Incorrect Authorization
CWE-285 Improper Authorization

Affected Products

Product	Versions
AstrBotAstrBotDevs	4.25.0Affected 4.25.1Affected 4.25.2Affected 4.25.3Affected 4.25.4Affected 4.25.5Affected

References

VDB-383394 | AstrBotDevs AstrBot astr_main_agent.py authorizationvdb-entrytechnical-description
VDB-383394 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-17529 | CVE Analysis and Reportthird-party-advisory
Submit #862512 | AstrBotDevs AstrBot 4.25.5 Incorrect Authorization (CWE-863)third-party-advisory
https://github.com/AstrBotDevs/AstrBot/issues/8780exploitissue-tracking
https://github.com/AstrBotDevs/AstrBot/pull/8786issue-trackingpatch
https://github.com/AstrBotDevs/AstrBot/commit/d23011262e8e75e1ec41b0f1f0091493a022327epatch
https://github.com/AstrBotDevs/AstrBot/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.