Executive brief
FastGPT is an AI platform used to build and deploy custom AI agents and workflows. A security flaw allows any registered user to access and run AI applications belonging to other organizations or teams by simply guessing or obtaining their application ID. This could lead to the theft of proprietary AI prompts, exposure of sensitive business logic, and unauthorized use of computing resources.
Technical details
An Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA), exists in multiple API endpoints including /api/v1/chat/completions and /api/core/chat/team/init. While the application correctly authenticates the user's team token, it fails to verify if the requested 'appId' belongs to the authenticated team's workspace. An attacker with valid credentials for their own team can provide a different team's appId to retrieve full application configurations, including system prompts and workflow nodes, or execute the AI model. The vulnerability is rooted in the lack of ownership validation during MongoDB lookups. This issue is resolved in version 4.14.10.4 by enforcing teamId checks during application retrieval.
Affected products
- labring FastGPT < 4.14.10.4
Timeline
- 2026-04-10: disclosed
- 2026-04-10: patched: Fixed in version 4.14.10.4
- 2026-04-10: advisory