FastGPT CVE-2026-61644

Exploitation requires an authenticated low-privileged tenant account on the FastGPT instance (CVSS PR:L) and a valid attacker-owned appId, chatId, chatItemDataId, and collectionId to pass the endpoint's context authentication; the attacker then supplies a foreign tenant's dataset data id as the initialId parameter to the POST /api/core/chat/record/getCollectionQuote endpoint. The concrete prerequisite is possession of (or ability to guess/enumerate) another tenant's dataset data id value. Limiting factors: the attacker must already hold a working account on the same instance, so single-tenant or trusted-user-only deployments are not meaningfully exposed; the flaw only discloses data (read-only, no write/DoS), and it affects only versions 4.14.17 through 4.15.0-beta5. No user interaction by the victim is needed.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) is internally consistent with the description: network-reachable, low complexity, requires only a low-privileged authenticated tenant account, no user interaction, and a scope change reflecting the cross-tenant confidentiality breach with no integrity or availability impact. This is a genuine confidentiality/data-isolation priority for any multi-tenant FastGPT deployment because it defeats tenant separation with a trivially craftable request. However, it is not a mass-exploitation or takeover class issue: PR:L means the attacker must already hold a valid tenant account, impact is read-only disclosure (I:N/A:N), and there is no KEV listing and no public exploit code identified. EPSS was not provided, so widespread automated exploitation probability cannot be quantified. Net: high-value for organizations running shared/multi-tenant FastGPT with untrusted users, lower for single-tenant self-hosted instances where the account prerequisite is not meaningfully crossed.

A low-privileged user with a legitimate account on a shared FastGPT instance creates their own app and chat, then calls POST /api/core/chat/record/getCollectionQuote with their own valid appId, chatId, chatItemDataId, and collectionId but substitutes another tenant's dataset data id as initialId. Because the initialId lookup is not authorization-bound, the response returns the victim tenant's dataset quote or full-text content, letting the attacker harvest confidential knowledge-base data by iterating over guessed or enumerated dataset ids. No public exploit code has been identified, but the low attack complexity (AC:L) means a working request is trivial to construct once endpoint parameters are understood.