Executive brief
FastGPT is an open-source platform used to build AI knowledge bases. A security flaw in the platform's training system allows a registered user from one organization (tenant) to access, modify, or delete data belonging to a different organization. This could lead to the unauthorized exposure of sensitive training data or the disruption of AI services for other customers using the same platform.
Technical details
An Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) exists in FastGPT's training endpoints. Specifically, the 'POST /api/core/dataset/collection/create/reTrainingCollection' endpoint allowed authenticated users to provide a 'datasetId' belonging to a different tenant. This resulted in 'mixed dataset objects' where ownership anchors became inconsistent. Downstream endpoints for dataset management and training then made authorization decisions based on these inconsistent anchors, enabling cross-tenant access if the target object IDs were known. The fix involves removing client-provided 'datasetId' from training contracts and deriving ownership strictly from the server-side authorized collection.
Affected products
- labring FastGPT >= 4.14.17, < 4.15.0-beta4
Timeline
- 2026-06-07: patched: Fix commit merged into main branch.
- 2026-06-10: advisory: Release v4.15.0-beta4 published.
- 2026-07-07: disclosed: CVE-2026-54601 published.