FastGPT
CVE-2026-68929
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRead victim shareId from public chat URL
-
DeliveryCall wechat/qrcode/generate for shareId
-
ExploitScan QR with attacker WeChat
-
ExecutionCall unauthenticated qrcode/status to write attacker bot creds
-
ImpactVictim app rebound to attacker bot, private responses exfiltrated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the victim team has configured and bound a WeChat (iLink) share channel/outLink in FastGPT, and that the attacker knows the victim's shareId - which is not a secret because it appears in every shared chat URL, iframe, and embed. Beyond that, no special conditions: the endpoints require no authentication (PR:N), no user interaction on the victim side (UI:N), and are reachable remotely against default configurations of affected FastGPT versions. The channel-hijack variant additionally requires the attacker to scan the generated QR with their own WeChat account. The only meaningful limiting factor is that a team must actually be using the WeChat/iLink feature; teams without it configured are not exposed. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3 and is consistent with the description: fully remote, low complexity, no privileges or user interaction, with high confidentiality, integrity, and availability impact on the vulnerable system and no scope/subsequent-system change. This is a genuine high-priority issue rather than an inflated CVSS number - exploitation prerequisites are minimal and the required shareId is openly exposed. No EPSS score and no KEV or POC signal were provided, so exploitation-in-the-wild cannot be asserted; the realistic risk is elevated by ease of exploitation but tempered by the product's limited enterprise footprint and the fact that only teams that have actually configured a WeChat/iLink channel are exposed. No conflicting signals were found between the CVSS vector and the description. |
| Exploit ScenarioDerived | An attacker copies the shareId from a public FastGPT shared-chat link or embed, calls the WeChat qrcode/generate endpoint for that victim shareId, scans the returned QR with their own WeChat account, and then calls the unauthenticated qrcode/status endpoint, which writes the attacker's bot credentials into the victim team's outLink. The victim team's app is now bound to the attacker's bot, leaking private responses and consuming the victim's resources; alternatively the attacker simply calls the logout endpoint to knock the victim's bot offline. No exploit code is publicly identified, but the attack requires only routine HTTP requests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker take over or disable a victim team's WeChat (iLink) bot binding. The WeChat share-channel endpoints authorize on the public shareId alone with no identity or team-ownership check, so an attacker who reads a shareId from any shared chat URL can wipe the stored WeChat token (offlining the bot) or bind the app to their own bot to siphon the team's private responses. No public exploit identified at time of analysis, but the flaw is trivially triggerable and fixed in version 4.15.2.
RemediationAI
Upgrade to FastGPT 4.15.2, which adds proper team-ownership and management-permission checks to the WeChat share-channel endpoints (Vendor-released patch: 4.15.2). Apply per the advisory at https://github.com/labring/FastGPT/security/advisories/GHSA-q4pr-3qpg-9q5v and the fix in commit 81d391995b1f9989455267448872ff88bb1f42c9. If immediate patching is not possible, compensating controls include restricting network access to the /api/support/outLink/wechat/* endpoints (qrcode/generate, qrcode/status, logout) at a reverse proxy or WAF so only trusted management origins can reach them - the trade-off is that legitimate admins must operate the WeChat binding from within that trusted network - and, where feasible, unbinding/disabling the WeChat (iLink) channel until upgraded, which removes the feature but stops the abuse. Rotate/re-establish any WeChat bot credentials after upgrading in case a binding was already hijacked.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FastGPT is an open-source LLM knowledge-base application platform (cpe:2.3:a:labring:fastgpt). The affected component is the outLink share-channel subsystem, specifically the newly added WeChat/iLink publishing endpoints (POST /api/support/outLink/wechat/qrcode/generate, GET /api/support/outLink/wechat/qrcode/status, POST /api/support/outLink/wechat/logout). The root cause is CWE-862 (Missing Authorization): these endpoints key off the shareId/outLinkId supplied by the caller without verifying that the caller is an authenticated member with management rights over the owning team. The status endpoint performs no authorization at all and persists attacker-supplied bot credentials into the outLink record, while the logout endpoint is gated only by an existence check before clearing the stored WeChat token. Because the shareId is embedded in every shared chat URL, iframe, and embed, it functions as a public identifier rather than a secret, collapsing the intended trust boundary.
Know when Fastgpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Endpoints authorize on a public shareId with no auth (PR:N, AV:N, AC:L); attacker reads private responses (C:H), rebinds the channel (I:H), and can offline the bot (A:H), all on one system so S:U.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated attacker who knows a victim team's shareId can take that team's WeChat bot offline or hijack the channel to their own bot: the logout endpoint is gated only by an existence check yet wipes the outLink's stored WeChat token, and the QR-code status endpoint performs no authorization at all and writes attacker-supplied bot credentials into the outLink identified by shareId. By generating a QR for a victim shareId, scanning it with their own WeChat, and calling the status endpoint, an attacker binds the victim team's app to the attacker's bot, exposing the app's private responses, displacing the legitimate binding, and consuming the victim's resources. The shareId is exposed in every shared chat URL, iframe, and embed, so it is not a secret. This issue is fixed in version 4.15.2.
Executive ViewAI
FastGPT installations before version 4.15.2 allow unauthorized individuals to intercept or disable WeChat bot integrations with a single HTTP request, requiring no credentials or prior access. Any organization using this platform for customer messaging via WeChat faces immediate risk of service disruption and exposure of sensitive team communications.
Apply vendor patch: upgrade to FastGPT version 4.15.2 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-ima
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tena
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Exploit-DB