labring FastGPT up to 4.15.0-beta4 File Handlers improper authorization

Summaryinfo

A vulnerability was found in labring FastGPT up to 4.15.0-beta4 and classified as problematic. Affected is an unknown function of the component File Handlers. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-55418. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in labring FastGPT up to 4.15.0-beta4. Affected is an unknown code of the component File Handlers. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. CVE summarizes:

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-55418 since 06/16/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 4.15.0-beta5 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• labring

Name

• FastGPT

Version

• 4.15.0-beta1
• 4.15.0-beta2
• 4.15.0-beta3
• 4.15.0-beta4

Website

• Product: https://github.com/labring/FastGPT/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion