The vulnerability in letta-ai LettaBot 0.2.0 involves missing authentication in an unspecified function within the API Status Route component (src/api/server.ts). This flaw enables remote attackers to bypass authentication controls. The issue has been publicly disclosed with exploit code available. The vendor was notified but has not issued any response or remediation guidance. No official patch or fix is currently documented.

Remote attackers can exploit the missing authentication to access the affected API route without credentials, potentially leading to unauthorized information disclosure or manipulation depending on the API functionality. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing compensating controls such as restricting network access to the API, adding external authentication proxies, or monitoring for suspicious access until an official patch is available.