EUVD-2026-42115Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any FastGPT team user
-
DeliveryObtain victim team's S3 object key
-
ExploitSubmit key to chat-file presign or dataset preview endpoint
-
ExecutionHandler signs/reads key without ownership check
-
ImpactRetrieve cross-tenant file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation targets FastGPT's chat-file presign endpoint or dataset preview endpoint and requires the attacker to supply another team's S3 object key; because keys are global within the bucket and carry the tenant id only as a path segment, the attacker must know or derive a victim key. Per the description the actor is a 'caller' with a 'team', so a valid FastGPT account is realistically required despite the published PR:N - the practical limiting factors are (1) needing knowledge of a target object key and (2) the deployment being multi-tenant with a shared bucket. Single-team or single-tenant installations have no other team's data to steal, materially reducing impact. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) rates this network-exploitable with no privileges and a changed scope reflecting cross-tenant impact, confidentiality-only. However, PR:N conflicts with the description, which frames the actor as a 'caller' with a 'team' - i.e. an authenticated tenant user abusing endpoints to reach other teams' data - so real-world exploitation almost certainly requires a valid FastGPT account rather than pure anonymous access; treat PR:N with caution and verify with the vendor. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation. No standalone POC is published, but the fix PR and commit disclose the vulnerable logic, lowering the bar to weaponization. Net: a credible, high-value confidentiality risk for multi-tenant FastGPT deployments, but likely gated behind authentication rather than a wormable unauthenticated bug. |
| Exploit ScenarioDerived | An authenticated user of Team A learns or guesses another team's S3 object key (keys embed the tenant id only as a path segment and may leak via logs, shared links, or enumeration) and submits it to the chat-file presign or dataset preview endpoint. FastGPT authorizes an unrelated resource, then signs or reads the attacker-supplied key, returning Team B's file contents. No POC is currently published, but the fix commit exposes the exact endpoints and missing check. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 07, 2026
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by supplying that team's S3 object key to the chat-file presign or dataset preview endpoints. The handlers authorize an unrelated resource but then sign or read the S3 object using a request-supplied key without verifying tenant ownership, so global bucket keys become an IDOR primitive. No public exploit code has been identified at time of analysis, though the upstream fix (PR #7104 / commit decb6d2) reveals the exact vulnerable code path.
RemediationAI
Upgrade to the fixed release: Vendor-released patch v4.15.0-beta5 (https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5), which adds tenant-ownership validation on the request-supplied S3 key. If you cannot upgrade immediately, restrict reachability of the chat-file presign and dataset preview endpoints to trusted networks or via an authenticating reverse proxy, and consider disabling or gating dataset preview for shared/multi-team instances (trade-off: loss of preview functionality for legitimate users). Where feasible, isolate tenants into separate buckets or enforce IAM/bucket policies that scope object access by tenant prefix so a stolen key alone cannot be signed cross-team (trade-off: operational overhead and storage restructuring). Review access logs for anomalous presign requests referencing keys outside the caller's team prefix. Refer to advisory GHSA-6rxv-p43w-mmx5 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FastGPT is an open-source LLM knowledge-base / RAG platform that stores uploaded chat files and dataset documents in an S3-compatible object bucket. Tenancy is expressed only as a path segment inside otherwise globally-unique object keys, meaning the bucket has no per-team isolation boundary at the storage layer. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): two file handlers validate access to some unrelated resource and then trust a key value taken directly from the request when generating a presigned URL or reading object contents, never re-checking that the key's embedded tenant id matches the caller's team. This is a classic broken-object-level-authorization pattern where the object identifier is attacker-controllable and the ownership check is missing.
Know when Fastgpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network endpoint abuse with low complexity, but the description's 'caller/team' framing implies an authenticated tenant user (PR:L); scope changes cross-tenant with high confidentiality-only impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.
Executive ViewAI
FastGPT prior to v4.15.0-beta5 contains an authorization bypass that exposes stored files across teams, allowing one team member to access another team's data through manipulated S3 object requests. Any organization using FastGPT with multiple teams is vulnerable to cross-team data disclosure, posing significant confidentiality and compliance risks. Leadership must immediately implement access controls and monitor for patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce strict IAM policies on S3 bucket access to prevent unauthorized cross-tenant key access, (2) Enable S3 object-level access logging and establish alerts for suspicious key patterns, (3) Deploy WAF rules blocking atypical S3 key requests from FastGPT endpoints, (4) Temporarily restrict multi-tenant file-sharing features if business permits, (5) Audit historical S3 access logs for evidence of exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-ima
Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tena
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Exploit-DB