The vulnerability resides in AstrBot’s Subagent component within the _build_handoff_toolset function of astr_agent_tool_exec.py. By manipulating input, an attacker can cause the function to grant improper authorization, effectively bypassing expected access controls. This flaw leads to unauthorized privilege escalation and potential lateral movement within systems that rely on AstrBot for command execution or automation.

Affected versions are AstrBot up to 4.25.5 by AstrBotDevs. The product family AstrBot, as identified by the Astrbot CPE string, is impacted across all platforms where Subagent is deployed. The patch commit d23011262e8e75e1ec41b0f1f0091493a022327e resolves the issue.

The CVSS v3 score of 5.3 indicates a moderate severity, and the EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack path is remote, and exploitation has been publicly released, suggesting that the risk to exposed installations is non‑negligible. An attacker would need the ability to supply crafted input to the toolset builder, which may be possible via exposed interfaces or network connections used by the subagent, making the vulnerability fairly exploitable in uncontrolled environments.