What is the CVSS score of CVE-2026-55418?

CVE-2026-55418 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of FastGPT are affected by CVE-2026-55418?

FastGPT prior to v4.15.0-beta5 contains an authorization bypass that exposes stored files across teams, allowing one team member to access another team's data through manipulated S3 object requests.. A patch is available.

How to fix or mitigate CVE-2026-55418?

Within 24 hours: Identify all FastGPT deployments; confirm whether multi-tenant configuration is enabled; audit S3 access logs for anomalous cross-tenant object key requests. Within 7 days: Restrict S3 bucket IAM policies to enforce strict per-team key isolation; enable S3 access logging with real-time alerts; communicate exposure risk to affected teams. Within 30 days: Monitor FastGPT vendor advisories for patched version (v4.15.0-beta5 or later); deploy patch immediately upon release; if unavailable, conduct complete file access audit across all teams.

FastGPT CVE-2026-55418

EUVD-2026-42115 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 GitHub_M

Authentication Bypass Fastgpt Labring

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network endpoint abuse with low complexity, but the description's 'caller/team' framing implies an authenticated tenant user (PR:L); scope changes cross-tenant with high confidentiality-only impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 07, 2026 - 23:01 EUVD

Analysis Generated

Jul 07, 2026 - 22:04 vuln.today

DescriptionCVE.org

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.

AnalysisAI

Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by supplying that team's S3 object key to the chat-file presign or dataset preview endpoints. The handlers authorize an unrelated resource but then sign or read the S3 object using a request-supplied key without verifying tenant ownership, so global bucket keys become an IDOR primitive. No public exploit code has been identified at time of analysis, though the upstream fix (PR #7104 / commit decb6d2) reveals the exact vulnerable code path.

Technical ContextAI

FastGPT is an open-source LLM knowledge-base / RAG platform that stores uploaded chat files and dataset documents in an S3-compatible object bucket. Tenancy is expressed only as a path segment inside otherwise globally-unique object keys, meaning the bucket has no per-team isolation boundary at the storage layer. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): two file handlers validate access to some unrelated resource and then trust a key value taken directly from the request when generating a presigned URL or reading object contents, never re-checking that the key's embedded tenant id matches the caller's team. This is a classic broken-object-level-authorization pattern where the object identifier is attacker-controllable and the ownership check is missing.

RemediationAI

Upgrade to the fixed release: Vendor-released patch v4.15.0-beta5 (https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5), which adds tenant-ownership validation on the request-supplied S3 key. If you cannot upgrade immediately, restrict reachability of the chat-file presign and dataset preview endpoints to trusted networks or via an authenticating reverse proxy, and consider disabling or gating dataset preview for shared/multi-team instances (trade-off: loss of preview functionality for legitimate users). Where feasible, isolate tenants into separate buckets or enforce IAM/bucket policies that scope object access by tenant prefix so a stolen key alone cannot be signed cross-team (trade-off: operational overhead and storage restructuring). Review access logs for anomalous presign requests referencing keys outside the caller's team prefix. Refer to advisory GHSA-6rxv-p43w-mmx5 for details.