This vulnerability in AstrBotDevs AstrBot 4.24.2 affects the astr_main_agent function by allowing an attacker to manipulate the session_id argument, resulting in authorization bypass. This flaw enables remote attackers to circumvent access controls without requiring user interaction or elevated privileges. The vendor has not issued any response or fix, and no official remediation is currently available. The exploit code is publicly accessible, but no known exploitation in the wild has been reported.

Successful exploitation allows remote attackers to bypass authorization mechanisms, potentially granting unauthorized access to protected functionality or data within AstrBot. This could lead to unauthorized actions or information disclosure depending on the application context. However, the impact is rated medium due to limited privileges required and low complexity of the attack.

No official fix or patch is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a patch is released, consider restricting network access to the affected service and implementing compensating controls to limit exposure of the vulnerable function.