Executive brief
FastGPT is an open-source AI application platform that allows teams to build chat applications backed by knowledge bases and integrate them with messaging services like WeChat. Unauthenticated attackers who know a team's public share identifier can disable the team's WeChat bot connection or hijack it to control the conversation, exposing the team's private knowledge base responses and consuming their resources.
Technical details
The vulnerability is a missing authorization check (CWE-862) in two WeChat integration endpoints: logout and qrcode/status. Both endpoints accept a public shareId parameter and call only authOutLinkValid(), which performs an existence check but does not verify the caller's identity or team ownership. An attacker can call POST /api/support/outLink/wechat/logout with any victim's shareId to offline their WeChat bot token (DoS), or generate a QR code for the victim's shareId, scan it with their own WeChat account, and call the unguarded qrcode/status endpoint to write their own bot credentials into the victim's outLink, hijacking the channel. The shareId is public and exposed in every shared chat URL, iframe, and embed. The fix, deployed in version 4.15.2, replaces the insufficient authOutLinkValid check with authenticated, team-scoped authorization equivalent to authOutLinkCrud.
Affected products
- labring FastGPT prior to 4.15.2
Timeline
- 2026-08-28: disclosed
- 2026-07-06: patched: Fixed in v4.15.2 via commit 81d39199