Fastgpt CVE-2026-40252

The CVSS v4.0 score of 5.3 reflects a Medium severity with network attack vector, low attack complexity, and low privilege requirements (authenticated user), but limited confidentiality impact and no integrity or availability impact in the base vector. The CVSS vector (AV:N/AC:L/PR:L) confirms unauthenticated users cannot exploit this-a valid team token is mandatory. However, the real-world risk is amplified in multi-tenant SaaS deployments: any paid subscriber or low-privileged user can systematically enumerate and access sensitive AI workflows, trained models, or configuration data of competing teams or organizations. The impact is primarily information disclosure (cross-tenant data exposure) and unauthorized execution of private workflows, making it a critical concern for data segregation compliance (SOC 2, ISO 27001). The availability of a patched version (4.14.10.4) and public GitHub advisory increases organizational visibility, reducing zero-day risk but elevating urgency for hosted instances. No EPSS score or KEV status provided; exploitation is straightforward (unauthenticated users are blocked, but any authenticated user can exploit), suggesting this will likely be actively exploited post-disclosure.

An authenticated user or team in a FastGPT SaaS instance obtains or observes another team's application ID (e.g., via shared documentation, error messages, or brute-force enumeration). The attacker constructs an API request to read or execute that application while supplying their own valid team token. Because the API validates the team token but does not verify the application belongs to the team, the request succeeds, exposing the application's configuration, trained models, or execution results. No additional complexity or privilege escalation is required-the attacker simply needs a valid team account, making this a high-probability horizontal privilege escalation in multi-tenant deployments. No public exploit code has been identified as of this analysis, but the simplicity of the attack (direct object reference) and availability of public advisory details make rapid exploitation likely post-disclosure.