This vulnerability affects the _build_handoff_toolset function in the AstrBot/astrbot/core/astr_agent_tool_exec.py file of AstrBotDevs AstrBot up to version 4.25.5. The issue results in incorrect authorization, potentially allowing remote attackers to perform unauthorized actions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. A patch identified by commit d23011262e8e75e1ec41b0f1f0091493a022327e exists, but no explicit vendor advisory or remediation level is provided. Exploit code has been publicly released, increasing the risk of exploitation.

The vulnerability allows remote attackers to bypass correct authorization checks in the affected function, potentially leading to unauthorized access or actions within the AstrBot application. The CVSS score of 5.3 reflects a medium impact with low attack complexity and no user interaction required. The presence of public exploit code increases the likelihood of exploitation.

A patch identified by commit d23011262e8e75e1ec41b0f1f0091493a022327e is available and should be applied promptly to remediate the issue. Since no official vendor advisory or remediation level is provided, users should verify patch availability from the vendor or source repository and apply the update to affected versions 4.25.0 through 4.25.5. Until patched, restrict access to the affected component if possible.