FastGPT EUVD-2026-42114

Exploitation requires a valid authenticated tenant user account (CVSS PR:L confirmed) on a FastGPT deployment running versions 4.14.17 through pre-4.15.0-beta4. The attacker must additionally know or successfully enumerate a valid datasetId belonging to a different tenant - this is a secondary prerequisite that somewhat raises practical complexity beyond the AC:L CVSS assessment. Single-tenant self-hosted deployments where all users share a single tenant context are not meaningfully affected, since there is no cross-tenant boundary to violate. Authentication is a firm prerequisite: unauthenticated network access to the endpoint alone is insufficient for exploitation.

The NVD CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) is consistent with the real-world risk profile. The network-accessible vector with low attack complexity and no user interaction interaction means exploitation is straightforward once an attacker has a valid tenant account. The PR:L requirement - an authenticated tenant user - is a meaningful gate in practice: anonymous exploitation is not possible, and the attacker must either possess or compromise a legitimate account. The S:U (unchanged scope) designation is debatable given that impact crosses tenant boundaries, which arguably represents a scope change in CVSS 3.1 terms; if scored S:C, the effective score and downstream impact ratings would increase. No EPSS data was provided in the input; the CVE is not listed in CISA KEV and no confirmed POC exists, indicating this is not currently being mass-exploited. Risk is real and prioritized for any organization running a shared multi-tenant FastGPT instance, but it is bounded by the authentication prerequisite and the attacker's need to enumerate or guess valid cross-tenant datasetId values.

An attacker with a valid low-privilege tenant account on a shared FastGPT instance sends a crafted POST request to /api/core/dataset/collection/create/reTrainingCollection, substituting the datasetId payload field with an identifier belonging to a victim tenant obtained through enumeration or prior reconnaissance. The persisted mixed-ownership collection object causes subsequent calls to dataset, collection, and training endpoints to pass authorization checks using the victim tenant's ownership anchor, enabling the attacker to read sensitive knowledge base content, alter training data, or delete collections belonging to the victim tenant without ever directly authenticating as them.