CVE-2026-15500
AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery
CVSS Score
6.3
EPSS Score
0.2%
EPSS Percentile
11th
A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashboard/routes/plugin.py of the component market_list Endpoint. Executing a manipulation of the argument custom_registry can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-918 |
| Vendor | astrbotdevs |
| Product | astrbot |
| Published | Jul 12, 2026 |
| Last Updated | Jul 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for astrbotdevs astrbot
Be the first to know when new medium vulnerabilities affecting astrbotdevs astrbot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
AstrBotDevs / AstrBot
4.25.0 4.25.1 4.25.2
References
vuldb.com: https://vuldb.com/vuln/377807 vuldb.com: https://vuldb.com/vuln/377807/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15500 vuldb.com: https://vuldb.com/submit/844659 vuldb.com: https://vuldb.com/submit/847481 gist.github.com: https://gist.github.com/YLChen-007/cd162554554c273a3a7c0330aa02f3f0
Credits
🔍 Eric-a (VulDB User) VulDB CNA Team