# CVE-2026-40252: FastGPT IDOR in chat and team initialization endpoints

Source: https://junglewise.ai/threats/cve-2026-40252-fastgpt-idor-in-chat-and-team-initialization-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40252 · Severity: high · CVSS 8.1 · Published 2026-04-10

FastGPT is an AI platform used to build and deploy custom AI agents and workflows. A security flaw allows any registered user to access and run AI applications belonging to other organizations or teams by simply guessing or obtaining their application ID. This could lead to the theft of proprietary AI prompts, exposure of sensitive business logic, and unauthorized use of computing resources.

Technologies: [Fastgpt](https://junglewise.ai/threats/technologies/fastgpt). Vendors: [Fastgpt](https://junglewise.ai/threats/vendors/fastgpt).

## Quick answers

**Is CVE-2026-40252 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40252 being exploited in the wild.

**How severe is CVE-2026-40252?** High severity, with a CVSS score of 8.1, published 10 April 2026.

**Which products and versions are affected?** labring FastGPT < 4.14.10.4.

**Is there a fix for CVE-2026-40252?** A patch was published on 2026-04-10: Fixed in version 4.14.10.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40252 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40252?** Check whether you run Fastgpt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA), exists in multiple API endpoints including /api/v1/chat/completions and /api/core/chat/team/init. While the application correctly authenticates the user's team token, it fails to verify if the requested 'appId' belongs to the authenticated team's workspace. An attacker with valid credentials for their own team can provide a different team's appId to retrieve full application configurations, including system prompts and workflow nodes, or execute the AI model. The vulnerability is rooted in the lack of ownership validation during MongoDB lookups. This issue is resolved in version 4.14.10.4 by enforcing teamId checks during application retrieval.

## Affected products

- labring FastGPT < 4.14.10.4

## Timeline

- 2026-04-10: disclosed
- 2026-04-10: patched: Fixed in version 4.14.10.4
- 2026-04-10: advisory

## References

- [https://github.com/labring/FastGPT/releases/tag/v4.14.10.4](https://github.com/labring/FastGPT/releases/tag/v4.14.10.4)
- [https://github.com/labring/FastGPT/security/advisories/GHSA-gc8m-w37w-24hw](https://github.com/labring/FastGPT/security/advisories/GHSA-gc8m-w37w-24hw)

## Related threats

- [FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to…](https://junglewise.ai/threats/cve-2026-40352-fastgpt-is-an-ai-agent-building-platform-in-versions-prior-to-4)
- [FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses…](https://junglewise.ai/threats/cve-2026-40351-fastgpt-is-an-ai-agent-building-platform-in-versions-prior-to-4)
- [labring FastGPT SSRF in mcpTools runTool endpoint](https://junglewise.ai/threats/cve-2026-40100-labring-fastgpt-ssrf-in-mcptools-runtool-endpoint)
- [labring FastGPT SSRF in MCP tools endpoints](https://junglewise.ai/threats/cve-2026-34163-labring-fastgpt-ssrf-in-mcp-tools-endpoints)
- [Labring FastGPT unauthenticated SSRF in HTTP tools endpoint](https://junglewise.ai/threats/cve-2026-34162-labring-fastgpt-unauthenticated-ssrf-in-http-tools-endpoint)