What is the CVSS score of CVE-2026-61644?

CVE-2026-61644 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of FastGPT are affected by CVE-2026-61644?

FastGPT 4.14.17 through 4.15.0-beta5 contains a multi-tenant isolation failure that allows any authenticated user within one customer account to retrieve proprietary datasets belonging to other…. A patch is available.

How to fix or mitigate CVE-2026-61644?

Within 24 hours, inventory all FastGPT deployments and confirm which are running versions 4.14.17 through 4.15.0-beta5; immediately restrict network access to the POST /api/core/chat/record/getCollectionQuote endpoint via API gateway, WAF, or firewall rules and enable verbose audit logging on all calls to this endpoint to detect cross-tenant queries. Within 7 days, implement attribute-based access controls (ABAC) that cryptographically bind dataset lookups to the authenticated tenant context, conduct forensic analysis of the past 90 days of access logs to identify any unauthorized cross-tenant data reads, and notify potentially affected customers of the vulnerability and audit findings. Within 30 days, monitor vendor advisories for a patched version of FastGPT and plan an immediate upgrade; if no patch is released within 60 days, initiate a migration to alternative LLM platforms with independently audited multi-tenant isolation controls.

FastGPT CVE-2026-61644

EUVD-2026-44677 HIGH

Incorrect Authorization (CWE-863)

2026-07-15 GitHub_M

Authentication Bypass Fastgpt Labring

7.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network endpoint, trivial request (AC:L), needs a low-priv tenant account (PR:L), no UI; crossing the tenant boundary yields a scope change (S:C) with high confidentiality but no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 15:21 vuln.today

Analysis Generated

Jul 15, 2026 - 15:21 vuln.today

CVE Published

Jul 15, 2026 - 14:30 cve.org

HIGH 7.7

DescriptionCVE.org

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collectionId values while supplying another tenant's dataset data id as initialId, causing the response to include foreign dataset quote or full-text content. This issue is fixed in version 4.15.0-beta5.

AnalysisAI

Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tenant's dataset content via the POST /api/core/chat/record/getCollectionQuote endpoint. The endpoint validates the caller's chat and collection context but fails to bind the initialId center-node lookup to that authorized context, so an attacker supplying a foreign dataset data id as initialId (while using their own valid appId, chatId, chatItemDataId, and collectionId) receives the victim tenant's dataset quote or full-text content. This is an authenticated (PR:L) authorization flaw with no public exploit identified at time of analysis and no CISA KEV listing; EPSS data was not provided.

Technical ContextAI

FastGPT is a self-hosted, knowledge-base AI application platform (RAG) that stores per-tenant datasets and serves grounding 'quotes' back to chat sessions. The vulnerable code path is the chat record collection-quote resolver, which retrieves the source dataset node referenced by an initialId. The root cause is CWE-863 (Improper Authorization): the endpoint performs an authorization check on the chat/collection context but then trusts a separate, attacker-controlled identifier (initialId) for the actual data fetch, so the enforced check does not cover the object actually returned - a classic insecure direct object reference within a multi-tenant boundary. The affected component is identified by CPE cpe:2.3:a:labring:fastgpt (vendor labring, product fastgpt), all versions in the 4.14.17-4.15.0-beta5 range.

RemediationAI

Vendor-released patch: upgrade to FastGPT 4.15.0-beta5 or later, which binds the initialId center-node lookup to the authorized chat/collection context; the fix is tracked in GHSA-mmg6-2g54-j896, PR 7173, and commit 0c1840c7773c5be5d777f86228651479e02155db. If you cannot upgrade immediately, reduce exposure by restricting who can obtain low-privileged tenant accounts and by treating the getCollectionQuote endpoint as sensitive: place the FastGPT API behind an authenticating reverse proxy or WAF and monitor or rate-limit POST requests to /api/core/chat/record/getCollectionQuote for anomalous initialId values that do not correspond to the caller's own datasets (trade-off: this is detective/heuristic only and cannot reliably distinguish legitimate cross-referencing without knowing tenant ownership). For strict isolation until patched, consider segregating tenants into separate FastGPT instances so a leaked initialId cannot resolve to another organization's data (trade-off: operational overhead and loss of shared-instance efficiency). Do not rely on network-layer controls alone since the abuse comes from authenticated users.