CVE-2026-79483 in FastGPT Community Edition

Sumário

de MITRE • 01/09/2026

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsável: MITRE
• Reservar: 25/08/2026
• Divulgação: 01/09/2026
• Moderação: aceite
• Entrada: VDB-397465
• CPE: pronto
• CWE: CWE-943 (confirmado)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-79483
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79483
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-79483/