CVE-2026-10212

MediumCVSS 6.3/10Last modified Jul 22, 2026

Description

A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manipulation of the argument session_id leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285 CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1021208.8A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a cl CVE-2026-1021218.6A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to a CVE-2026-1021224.3Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authentica CVE-2026-1021237.4A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthentica CVE-2026-1021246.5A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthentica CVE-2026-1021258.8The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already execut CVE-2026-1021268.1A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated CVE-2026-1021277.0An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message CVE-2026-1021287.5An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a CVE-2026-1021297.2A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assign CVE-2026-102135.4A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6. This vulnerability affects unknown code of the file /api/skills/delete of CVE-2026-1021307.2Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influenc