This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-40252 | BDVDB-2026-326413 Detail

labringFastGPT

Description#

FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team. This leads to cross-tenant data exposure and unauthorized execution of private AI workflows. This vulnerability is fixed in 4.14.10.4.

Impact#

Per CVSS v4.0: confidentiality impact low, integrity impact none, availability impact low. Attack vector: network.

Weaknesses#

  • CWE-284 Improper Access Control
  • CWE-639 Authorization Bypass Through User-Controlled Key

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.