Fastgpt EUVD-2026-23559

Exploitation requires the attacker to possess valid low-privileged credentials (PR:L) for any account on the FastGPT instance-this is NOT exploitable by unauthenticated attackers. The vulnerability exists in default configurations of affected versions (prior to 4.14.9.5) with no special feature enablement required. The attacker must have network access to the password change API endpoint (AV:N) and understanding of MongoDB query operator syntax, though this is publicly documented knowledge. No user interaction is required (UI:N). What LIMITS exploitation: initial authentication barrier means attackers need existing credentials from credential stuffing, phishing, previous breach, or another vulnerability. The attack cannot be launched remotely without first compromising at least one low-privilege account. Organizations with strong credential hygiene, MFA enforcement, and no prior account compromises face significantly lower practical risk despite the high CVSS score.

The CVSS score of 8.8 (High) reflects network-based attack vector with low complexity, but requires low-privileged authentication (AV:N/AC:L/PR:L/UI:N). Real-world risk is elevated because the vulnerability enables persistence and privilege escalation from any compromised low-privilege account. The attack is automatable once an attacker has initial credentials (phishing, credential stuffing, or session hijacking), making lateral movement trivial. Not currently listed in CISA KEV, indicating no confirmed widespread exploitation. EPSS data not provided, but NoSQL injection techniques are well-known and easily exploitable once an attacker has authenticated access. The technical impact is complete account control (C:H/I:H/A:H), allowing data exfiltration, system manipulation, and denial of service. Primary risk factor: this converts any low-privilege compromise into full account takeover with persistence, particularly dangerous in multi-tenant AI platforms handling sensitive prompts and data. The fix is available (v4.14.9.5), significantly reducing risk for patched systems, but unpatched instances remain highly vulnerable to authenticated attackers.

An attacker obtains low-privileged credentials to a FastGPT instance through phishing or credential reuse. Instead of submitting their actual current password to the password change endpoint, they inject a MongoDB query operator payload like {"$ne": null} in the old password field. The vulnerable endpoint passes this object directly into the MongoDB query, causing the password verification logic to evaluate as true regardless of the actual stored password. The attacker successfully changes the password to a value they control, locking out the legitimate user and maintaining persistent access even if the original credentials are revoked. If combined with user ID manipulation in the same request, the attacker could potentially change passwords for other users including administrators.