CVE-2026-55418

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.6 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N                                    

Vulnerability Description

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.

Vulnerability Details

Published Date

July 07, 2026

Last Modified

July 07, 2026

CWE ID

CWE-639

Source

NVD

Vendor

labring

Product

FastGPT

External References

https://github.com/labring/FastGPT/commit/decb6d2fb1417fb9e2bca145d2dcc9cbcf06396c
https://github.com/labring/FastGPT/pull/7104
https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5
https://github.com/labring/FastGPT/security/advisories/GHSA-6rxv-p43w-mmx5

CVE-2026-55418

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment