AstrBotDevs AstrBot 4.23.6 contains an authorization vulnerability in the _normalize_rw_path function within the file astrbot/core/tools/computer_tools/fs.py. This incorrect authorization issue can be triggered remotely, potentially allowing unauthorized actions. The vulnerability was publicly disclosed without vendor response or an available patch. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

The vulnerability allows remote attackers to bypass proper authorization controls in the affected function, potentially leading to unauthorized access or actions within the AstrBot application. The exact impact depends on how the _normalize_rw_path function is used, but it may enable unauthorized read/write operations. No known exploits are reported in the wild.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Users should monitor vendor communications for updates. Until a fix is released, consider restricting network access to the affected AstrBot instance and applying compensating controls to limit exposure to untrusted users.