FastGPT CVE-2026-54602

Exploitation requires an authenticated FastGPT account (PR:L per CVSS) and knowledge of a valid requestId belonging to another team, targeting the GET /api/core/ai/record/getRecord endpoint on any FastGPT instance prior to 4.15.0 operating with multiple teams/tenants. No user interaction, elevated privileges, or special non-default feature toggle is needed - the vulnerable endpoint is part of the standard AI record functionality. What LIMITS exploitation: the attacker must already hold a valid login on the instance, and must know or successfully guess the target requestId; if requestIds are high-entropy and not leaked, the attacker cannot trivially enumerate victims, whereas guessable/sequential IDs would remove this barrier.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H only) yields 7.1 and accurately reflects a confidentiality-only, network-reachable, low-privilege issue with no integrity or availability impact - consistent with the description. Real-world risk is moderate rather than critical: exploitation needs a valid authenticated account (PR:L) and a known requestId, which limits opportunistic mass exploitation but is very achievable for a malicious tenant or a compromised low-privilege account. No EPSS score, KEV entry, or public POC was provided, so there is no evidence of active exploitation; the primary danger is targeted cross-tenant data disclosure. The main uncertainty is requestId predictability - if IDs are sequential or otherwise guessable, automatable enumeration becomes feasible and risk rises; if they are high-entropy UUIDs, an attacker generally needs to obtain IDs out-of-band, reducing practical exploitability.

A user on Team A signs up for or already holds a low-privilege FastGPT account on a shared instance, then calls GET /api/core/ai/record/getRecord with a requestId belonging to Team B - obtained by guessing, enumeration, or from leaked logs/links. Because the server never checks team ownership, it returns Team B's full LLM trace, disclosing confidential prompts, proprietary RAG source chunks, and model completions. No public POC is documented, but the attack requires only routine authenticated HTTP requests and a valid target requestId.