CVE-2026-40252: FastGPT Auth Bypass Vulnerability

CVE-2026-40252 Overview

CVE-2026-40252 is a Broken Access Control vulnerability affecting FastGPT, an AI Agent building platform. Prior to version 4.14.10.4, the platform contains an Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) flaw that allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team, leading to cross-tenant data exposure and unauthorized execution of private AI workflows.

Critical Impact

Authenticated attackers can access and execute private AI applications across tenant boundaries, exposing sensitive data and workflows belonging to other organizations.

Affected Products

• FastGPT versions prior to 4.14.10.4

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-40252 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-40252

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control). The FastGPT platform implements multi-tenant architecture where multiple teams can create and manage their own AI applications and workflows. The application API endpoints accept an appId parameter to identify which application to access or execute.

The core issue lies in the authorization logic: while the platform properly authenticates incoming requests by validating team tokens, it fails to perform object-level authorization checks. This means the system does not verify whether the authenticated team actually owns or has permission to access the requested application specified by the appId parameter.

An attacker from one team can enumerate or guess valid appId values belonging to other teams and gain unauthorized access to those applications. This enables cross-tenant data exposure where confidential AI configurations, training data, and workflow logic may be revealed to unauthorized parties.

Root Cause

The root cause is missing authorization validation at the object level. The API endpoint processes requests based solely on authentication (valid team token) without verifying that the requested resource (appId) belongs to the authenticated team's scope. This is a classic BOLA/IDOR vulnerability pattern where resource ownership is not checked after authentication succeeds.

Attack Vector

The attack is network-based and requires low privileges (valid authenticated team account). An attacker can exploit this vulnerability by:

1. Authenticating with valid team credentials to obtain an API token
2. Identifying or enumerating appId values belonging to other teams
3. Making API requests with foreign appId values using their valid authentication token
4. Accessing application configurations, data, or executing workflows belonging to victim teams

The vulnerability requires no user interaction and can be exploited remotely over the network. The attack complexity is low since no special conditions need to be met beyond having valid authentication credentials for any team on the platform.

Detection Methods for CVE-2026-40252

Indicators of Compromise

• Unusual API access patterns where a single team token accesses multiple applications belonging to different teams
• Audit logs showing application access or execution requests for appId values not associated with the authenticated team
• Spike in application enumeration attempts or sequential appId requests from a single source

Detection Strategies

• Implement monitoring for cross-tenant access attempts by correlating team authentication tokens with accessed appId ownership
• Deploy API security solutions that can detect BOLA/IDOR patterns based on authorization boundary violations
• Review access logs for patterns where authenticated entities request resources outside their authorized scope

Monitoring Recommendations

• Enable detailed audit logging for all application access and execution API endpoints
• Monitor for anomalous patterns of appId parameter usage that don't match expected team-to-application relationships
• Set up alerts for high-volume application enumeration attempts from single sources

How to Mitigate CVE-2026-40252

Immediate Actions Required

• Upgrade FastGPT to version 4.14.10.4 or later immediately
• Audit access logs to identify potential exploitation attempts or unauthorized cross-tenant access
• Review any sensitive AI workflows or applications that may have been accessed by unauthorized parties

Patch Information

The vulnerability has been addressed in FastGPT version 4.14.10.4. Organizations should update to this version or later to remediate the vulnerability. Detailed information about the fix is available in the GitHub FastGPT Release v4.14.10.4 and the GitHub Security Advisory GHSA-gc8m-w37w-24hw.

Workarounds

• Implement network-level access controls to restrict API access to trusted sources while awaiting patch deployment
• Deploy a Web Application Firewall (WAF) with rules to detect and block suspicious IDOR patterns
• Consider temporarily disabling public API access to sensitive application endpoints until the patch is applied