Executive brief
AstrBot, a chatbot framework, contains a security flaw in how it handles user chat sessions. An authenticated attacker can manipulate session identifiers to trick the system into modifying or interacting with another user's chat session. This could lead to unauthorized changes to session metadata, such as renaming chat titles, and potentially disrupt user isolation and data integrity.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in `astrbot/core/astr_main_agent.py` due to unsafe string parsing of the `session_id` parameter. The application uses a delimiter (`!`) to concatenate session information and subsequently extracts the ID using `.split("!")[-1]`. Because the user-supplied `session_id` is not sanitized for the delimiter character, an attacker can inject a crafted string (e.g., `attacker!victim_session_id`) to force the backend to resolve to a victim's session ID. This allows an authenticated remote attacker to perform unauthorized actions, such as renaming session titles via the `//rename` command, affecting data integrity. As of the advisory date, no patch has been released by the vendor.
Affected products
- AstrBotDevs AstrBot <= 4.24.2
Timeline
- 2026-05-06: disclosed: Initial researcher disclosure via GitHub Gist
- 2026-06-01: advisory: GitHub Advisory and NVD publication