CVE-2026-79483 in FastGPT Community Edition
Summary
by MITRE • 08/31/2026
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in FastGPT Community Edition versions 4.10.0 through 4.14.0 represents a critical security flaw within the application's backend API logic, specifically targeting the POST /api/core/chat/getHistories endpoint. This issue stems from improper input validation and sanitization of JSON payloads sent by clients requesting chat history data. In modern web applications that utilize NoSQL databases such as MongoDB, developers often construct database queries dynamically based on user-supplied parameters. When these inputs are not rigorously validated against a whitelist of expected values or properly escaped before being incorporated into query objects, attackers can inject malicious operators native to the underlying database engine. This specific class of vulnerability is categorized under CWE-943 as Improper Neutralization of Special Elements used in an NoSQL Query, commonly referred to as NoSQL injection. The flaw allows an unauthenticated actor to manipulate the structure of the database query itself rather than just its data values, fundamentally altering how the server interprets the request for chat history records.
The operational impact of this vulnerability is severe due to the nature of the affected endpoint and the lack of authentication requirements for exploitation. By crafting a JSON payload that includes specific NoSQL operators such as $gt (greater than), $lt (less than), or regex patterns, an attacker can bypass standard authorization checks designed to restrict access to chat history titles. Typically, these endpoints are intended to return only the histories associated with the currently authenticated user session. However, through injection techniques like setting a condition that is always true for any record in the database collection, the attacker forces the server to retrieve and expose historical data belonging to all users on the platform. This results in a comprehensive breach of confidentiality, where sensitive information regarding conversation topics, titles, and potentially metadata associated with those conversations becomes accessible to unauthorized parties. The exposure of chat history titles can facilitate further social engineering attacks or provide intelligence for targeted phishing campaigns against specific individuals within an organization using the FastGPT service.
From a threat modeling perspective aligned with industry standards such as MITRE ATT&CK, this vulnerability facilitates initial access and data exfiltration phases. It aligns with techniques related to exploiting software vulnerabilities to gain unauthorized access to information stored in databases. The ability to retrieve arbitrary records without authentication indicates a failure in the principle of least privilege and proper session management enforcement at the API layer. Attackers can automate the extraction of large volumes of chat history titles, creating a significant privacy violation for all users registered on the platform. This is particularly concerning given that FastGPT is often deployed as an AI-powered knowledge base tool where conversations may contain proprietary business information or personal data subject to regulatory compliance frameworks like GDPR or HIPAA if applicable.
To mitigate this vulnerability and prevent similar issues in future development cycles, immediate remediation steps must focus on strict input validation and secure query construction practices. Developers should avoid constructing database queries using string concatenation or direct interpolation of user-supplied fields into JSON objects without verification. Instead, they should implement a whitelist approach where only predefined field names are allowed to be queried against the database. For example, if the application expects requests for specific metadata keys, those keys must be validated before being used in the query filter object. Additionally, implementing robust authentication and authorization middleware that strictly verifies user identity and permissions before processing any request is essential, although this particular flaw allows bypassing such checks due to the injection mechanism itself. Upgrading to a patched version of FastGPT beyond 4.14.0 where these input sanitization measures have been applied by the vendor is the primary recommended action for affected deployments. Furthermore, deploying Web Application Firewalls with rules capable of detecting NoSQL injection patterns can provide an additional layer of defense against exploitation attempts in environments where immediate patching is not feasible.