CVE-2026-61643

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5
https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch
https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) FastGPT es una plataforma de aplicación de IA basada en conocimiento. Desde la versión 4.14.17 hasta la 4.15.0-beta5, un usuario autenticado de FastGPT puede guardar un nodo de flujo de trabajo que apunta al conjunto de herramientas HTTP privado de otro usuario utilizando un ID de herramienta guardado manipulado, como http-[victim_toolset_app_id]/[tool_name]. Las rutas normales del conjunto de herramientas deniegan el acceso, pero la ruta de guardado y tiempo de ejecución del flujo de trabajo no aplicó la misma comprobación de autorización al conjunto de herramientas referenciado, permitiendo que /API/v2/chat/completions resolviera la referencia guardada y ejecutara la herramienta HTTP propiedad de la víctima. Este problema está solucionado en la versión 4.15.0-beta5.

Information

Published : 2026-07-15 18:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-61643

Mitre link : CVE-2026-61643

CVE.ORG link : CVE-2026-61643

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-61643", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61643", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T14:31:52.902899Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "labring", "product": "FastGPT", "versions": [{"status": "affected", "version": ">= 4.14.17, < 4.15.0-beta5"}]}]}], "published": "2026-07-15T18:16:49.510", "references": [{"url": "https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5", "source": "security-advisories@github.com"}, {"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch", "source": "security-advisories@github.com"}, {"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5."}, {"lang": "es", "value": "FastGPT es una plataforma de aplicaci\u00f3n de IA basada en conocimiento. Desde la versi\u00f3n 4.14.17 hasta la 4.15.0-beta5, un usuario autenticado de FastGPT puede guardar un nodo de flujo de trabajo que apunta al conjunto de herramientas HTTP privado de otro usuario utilizando un ID de herramienta guardado manipulado, como http-[victim_toolset_app_id]/[tool_name]. Las rutas normales del conjunto de herramientas deniegan el acceso, pero la ruta de guardado y tiempo de ejecuci\u00f3n del flujo de trabajo no aplic\u00f3 la misma comprobaci\u00f3n de autorizaci\u00f3n al conjunto de herramientas referenciado, permitiendo que /API/v2/chat/completions resolviera la referencia guardada y ejecutara la herramienta HTTP propiedad de la v\u00edctima. Este problema est\u00e1 solucionado en la versi\u00f3n 4.15.0-beta5."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}