Executive brief
FastGPT, an AI application platform used for building knowledge bases, contains a security flaw that allows users to access data they do not own. A logged-in user could manipulate specific web requests to view the private dataset content or full-text quotes belonging to other organizations (tenants) on the same platform. This could lead to the unauthorized exposure of sensitive proprietary information or private documents stored within the AI's knowledge base.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the POST /api/core/chat/record/getCollectionQuote endpoint of FastGPT. While the application validates the caller's chat and collection context, it fails to properly bind the 'initialId' center-node lookup to that authorized context. A remote attacker with low-privileged tenant access can provide their own valid appId, chatId, and collectionId while substituting the 'initialId' with a data ID belonging to a different tenant. This allows the attacker to retrieve quotes or full-text content from foreign datasets. The issue is resolved in version 4.15.0-beta5.
Affected products
- labring FastGPT >= 4.14.17, < 4.15.0-beta5
Timeline
- 2026-06-24: patched: Fixed in version 4.15.0-beta5
- 2026-07-15: disclosed: CVE-2026-61644 published