This vulnerability in AstrBotDevs AstrBot (versions 4.25.0 to 4.25.5) involves an authorization bypass in the OpenApiRoute.get_chat_sessions function of the session-listing endpoint. By manipulating the Username parameter, an attacker can bypass authorization controls remotely. The vulnerability is publicly known with an exploit published, but the vendor has not issued any fix or advisory. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an attacker to bypass authorization controls on the session-listing endpoint, potentially exposing chat session information without proper permissions. This could lead to unauthorized access to sensitive session data. The vulnerability is remotely exploitable without user interaction and requires no privileges, increasing the risk of unauthorized data disclosure.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the affected endpoint through network controls or application-layer filtering to limit exposure. Avoid exposing the OpenApiRoute.get_chat_sessions endpoint to untrusted networks.