Gửi #852863: AstrBotDevs AstrBot <= 4.25.5 Authorization Bypass Through User-Controlled Key (CWE-639)

# Technical Details
An authorization bypass exists in the `OpenApiRoute.get_chat_sessions` method in `astrbot/dashboard/routes/open_api.py` of AstrBot.

The application authenticates OpenAPI callers with an API key and stores the trusted principal in `g.username`, but the session-listing endpoint ignores that server-derived identity and instead trusts the caller-controlled `username` query parameter as the database ownership filter.

# Vulnerable Code
File: `astrbot/dashboard/server.py`
Method: OpenAPI API-key middleware
Why: The middleware correctly validates the API key and sets `g.username = f"api_key:{api_key.key_id}"`, creating a trusted authenticated principal.

File: `astrbot/dashboard/routes/open_api.py`
Method: `OpenApiRoute.get_chat_sessions`
Why: The endpoint resolves `request.args.get("username")` and passes the attacker-controlled value as `creator=username` to `self.db.get_platform_sessions_by_creator_paginated(...)`, so a `chat`-scope API key holder can enumerate sessions owned by another user.

# Reproduction
1. Run AstrBot `<= 4.25.5` with the dashboard/OpenAPI service enabled.
2. Log into `/api/auth/login` and create a valid OpenAPI key with `chat` scope via `/api/apikey/create`.
3. Create or identify a victim-owned WebChat session, for example under `dashboard-admin`.
4. Send `GET /api/v1/chat/sessions?username=dashboard-admin&page=1&page_size=20&platform_id=webchat` with header `X-API-Key: <chat-scope-api-key>`.
5. Observe that the response includes session IDs and metadata belonging to the supplied `username`.
6. Change only `username` to an unrelated user and observe that the session list becomes empty, confirming the leak depends on the caller-controlled key.

# Impact
- Any holder of a `chat`-scope API key can enumerate WebChat sessions belonging to other users by supplying their usernames.
- Exposed data includes session identifiers, platform identifiers, creator names, display names, and creation/update timestamps.
- The leaked session metadata can support follow-on attacks against endpoints that accept `session_id`, `username`, or related routing identity values.

• Nguồn: ⚠️ https://gist.github.com/YLChen-007/5fee3adfd95333b0f4eff8165af61f81
• Người dùng: Eric-d (UID 96861)
• Đệ trình: 09/06/2026 12:05 (cách đây 1 tháng)
• Kiểm duyệt: 17/07/2026 15:39 (1 month later)
• Trạng thái: được chấp nhận
• Mục VulDB: 379790 [AstrBotDevs AstrBot đến 4.25.5 session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions tên người dùng nâng cao đặc quyền]
• điểm: 20