Executive brief
FastGPT is an AI application platform used to build knowledge-based workflows. A security flaw allows an authenticated user to bypass permission checks and execute private automation tools (HTTP toolsets) belonging to other users or teams. By crafting a specific workflow configuration, an attacker could potentially access sensitive data or trigger actions using another user's credentials and private integrations.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in FastGPT's workflow management component. While standard API routes for toolsets correctly enforce ownership checks, the workflow 'save' and 'runtime' paths fail to validate that the user has permission to reference a specific toolset ID. An authenticated attacker can manually craft a tool ID (e.g., 'http-<victim_id>/<tool_name>') within their own workflow configuration. When the workflow is executed via the chat completions API, the system resolves and runs the victim's private HTTP tool, potentially exposing sensitive responses or utilizing the victim's configured credentials. This issue is resolved in version 4.15.0-beta5.
Affected products
- labring FastGPT >= 4.14.17, < 4.15.0-beta5
Timeline
- 2026-07-01: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date
- 2026-06-24: patched: Version 4.15.0-beta5 released