Is there a patch available for CVE-2026-40252?

Yes, a patch is available for CVE-2026-40252. Update the affected software to the latest version immediately.

Fastgpt CVE-2026-40252

Q: What is the CVSS score of CVE-2026-40252?

CVE-2026-40252 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21605 MEDIUM

Improper Access Control (CWE-284)

2026-04-10 GitHub_M

Information Disclosure Authentication Bypass Fastgpt

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.14.10.4

EUVD ID Assigned

Apr 10, 2026 - 21:00 euvd

EUVD-2026-21605

Analysis Generated

Apr 10, 2026 - 21:00 vuln.today

CVE Published

Apr 10, 2026 - 20:52 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team. This leads to cross-tenant data exposure and unauthorized execution of private AI workflows. This vulnerability is fixed in 4.14.10.4.

AnalysisAI

Broken Access Control in FastGPT versions prior to 4.14.10.4 allows authenticated teams to access and execute applications belonging to other teams by supplying a foreign application ID, enabling cross-tenant data exposure and unauthorized workflow execution. The vulnerability stems from insufficient API validation-while team tokens are verified, the API fails to confirm that the requested application belongs to the authenticated team. This affects all FastGPT instances with multi-tenant deployments where different teams manage separate AI Agent applications, and is fixed in version 4.14.10.4.

Technical ContextAI

FastGPT is a multi-tenant AI Agent building platform that uses team-based access control to isolate applications and workflows. The vulnerability is rooted in CWE-284 (Improper Access Control), specifically a horizontal privilege escalation pattern where API endpoints that accept an appId parameter perform team token validation but omit authorization checks to confirm the application belongs to the requesting team. This is a classic Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) flaw common in REST APIs handling multi-tenant resources. The affected product is specified in CPE as cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:* for all versions prior to the patched release.

RemediationAI

Upgrade FastGPT to version 4.14.10.4 or later immediately. The patched release is available at https://github.com/labring/FastGPT/releases/tag/v4.14.10.4 and includes API authorization logic that validates both team token ownership and application ownership before allowing access or execution. For organizations unable to upgrade immediately, implement network-level access controls to restrict API exposure to trusted internal networks or implement request-level rate limiting on application enumeration endpoints to reduce attack surface. Verify post-upgrade that API endpoints for executing or reading applications now properly reject cross-tenant requests with a 403 Forbidden response.