A remote attacker can manipulate the argument req.func_tool in AstrBot's core astr_main_agent.py to bypass normal authorization checks. This lets the attacker invoke privileged functions or execute arbitrary code that should be restricted, thereby compromising confidentiality, integrity, and potentially availability of the system. The flaw stems from an incorrect handling of the function-tool parameter, meaning that users who should not have permissions can obtain them.

The vulnerability affects all releases of AstrBot up to version 4.25.5, supplied by AstrBotDevs. Any deployment of those versions that exposes the astr_main_agent interface to external input is susceptible.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score is 0.00358 (less than 1%), but the exploit is publicly accessible and can be triggered remotely, suggesting the opportunity for real-world exploitation. The attacker requires only the ability to supply a crafted request containing a malicious func_tool value to gain unauthorized privileges.