This vulnerability affects AstrBotDevs AstrBot up to version 4.25.5 in the OpenApiRoute.get_chat_sessions function of the astrbot/dashboard/routes/open_api.py file. By manipulating the Username parameter, an attacker can bypass authorization checks on the session-listing endpoint, potentially gaining unauthorized access to chat session information. The vulnerability is remotely exploitable without requiring user interaction. Despite early contact, the vendor has not issued any advisory or patch. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality.

Successful exploitation allows an attacker to bypass authorization controls on the session-listing endpoint, potentially exposing chat session data that should be restricted. The impact is limited to information disclosure with low confidentiality impact as per the CVSS vector. There is no indication of privilege escalation, integrity, or availability impact.

No official fix or patch is currently available, and the vendor has not responded to disclosure. Users should monitor vendor channels for updates. Until a patch is released, consider restricting access to the affected endpoint by network controls or authentication proxies to limit exposure. Review and harden authorization checks in the OpenApiRoute.get_chat_sessions function if possible.