EUVD-2026-68876
GHSA-5ph8-357j-4hx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed FastGPT instance
-
DeliverySend unauthenticated POST to /api/core/chat/getHistories
-
ExploitInject MongoDB operators in JSON body
-
ExecutionBypass per-user authorization filter
-
ImpactEnumerate chat history titles for all platform users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | The POST /api/core/chat/getHistories API endpoint must be network-reachable - the default in publicly deployed FastGPT instances. The CVSS PR:N vector confirms no authentication is required. Exploitation is version-specific to FastGPT Community Edition 4.10.0 through 4.14.0; versions outside this range are not confirmed affected. Impact is bounded to chat history titles (metadata) rather than full message content, which limits the sensitivity of the disclosed data but still enables cross-user enumeration. No non-default configuration is required - any default deployment within the affected version range is exploitable. The primary limiting factor is deployment exposure: instances behind a VPN or restricted to internal networks are not reachable by external attackers. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium) accurately captures the technical parameters: network-accessible, trivial complexity, no authentication, no user interaction. However, the C:L rating understates practical business impact on a multi-tenant AI platform where chat history titles can reveal sensitive user intent, project names, or proprietary topics across the entire user base. The presence of a named public PoC repository is a significant threat amplifier beyond what CVSS conveys. EPSS at 0.33% (26th percentile) suggests exploitation has not yet become widespread, and the vulnerability is not in CISA KEV. Taken together, the real-world risk sits above what the 5.3 score implies for any internet-exposed FastGPT deployment: low attack complexity plus a public PoC plus no authentication equals a credible opportunistic threat. No conflicting signals between CVSS vector and the description - both consistently indicate a remote, unauthenticated, low-complexity read-only exploit. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a POST request to /api/core/chat/getHistories on an internet-exposed FastGPT 4.10.0-4.14.0 instance, embedding a MongoDB operator such as {"userId": {"$regex": ".*"}} in the JSON payload to override the intended per-user authorization filter. The application passes the unsanitized object directly to the MongoDB query, which returns chat history title records for all users on the platform. A public PoC (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) demonstrates this technique, requiring no prior knowledge of valid user credentials or identifiers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
NoSQL injection in FastGPT Community Edition 4.10.0-4.14.0 allows unauthenticated remote attackers to bypass authorization on the POST /api/core/chat/getHistories endpoint by embedding MongoDB operators in crafted JSON payloads, exposing chat history titles for all users across the platform. A public proof-of-concept repository (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) exists, materially lowering the exploitation bar. EPSS at 0.33% (26th percentile) indicates no widespread exploitation observed yet, but the zero-authentication-required, low-complexity attack surface makes this a realistic opportunistic threat against internet-exposed deployments.
RemediationAI
No specific patched release version is identified in the available reference data; administrators should monitor https://github.com/labring/FastGPT for a security release and upgrade as soon as one is published. As an immediate compensating control, restrict network access to the POST /api/core/chat/getHistories endpoint to authenticated internal networks only, or enforce authenticated sessions at the reverse-proxy or API gateway layer before the request reaches the application - this eliminates the unauthenticated attack vector but may disrupt API clients that rely on session-free access. A WAF rule rejecting JSON request bodies that contain MongoDB operator keywords (fields beginning with $) is a targeted mitigation with low false-positive risk on this endpoint. Disabling or rate-limiting the endpoint entirely until a patch is applied is the most conservative option, at the cost of breaking chat history retrieval for all users.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FastGPT is an open-source LLM application platform (labring/FastGPT on GitHub) typically built on Node.js with MongoDB as its data store. The vulnerable endpoint POST /api/core/chat/getHistories retrieves chat history records. CWE-943 (Improper Neutralization of Special Elements in Data Query Logic - NoSQL) describes the root cause: user-supplied JSON request bodies are passed into MongoDB query constructors without stripping or validating operator keys such as $regex, $ne, $gt, or $where, allowing an attacker to rewrite query semantics rather than supply values. Because Node.js frameworks like Express parse JSON bodies directly into JavaScript objects, and MongoDB queries are themselves JavaScript objects, the trust boundary between input data and query structure collapses when sanitization is absent. The NVD CPE entry is recorded as cpe:2.3:a:n/a:n/a which is a placeholder - the correct product is FastGPT by labring.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated API with trivial complexity; impact limited to reading chat history titles with no integrity or availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
Exploit-DB