CVE-2026-61644: FastGPT Information Disclosure Flaw

CVE-2026-61644 Overview

CVE-2026-61644 is a broken authorization vulnerability [CWE-863] in FastGPT, a knowledge-based AI application platform developed by labring. The flaw resides in the POST /api/core/chat/record/getCollectionQuote endpoint. While the endpoint validates the caller's chat and collection context, it fails to bind the initialId center-node lookup to that authorized context. A low-privileged tenant user can supply another tenant's dataset data id as initialId and retrieve foreign dataset quote or full-text content. The issue affects FastGPT versions from 4.14.17 up to 4.15.0-beta5 and is fixed in 4.15.0-beta5.

Critical Impact
Authenticated low-privileged tenants can read confidential dataset content belonging to other tenants, breaking multi-tenant data isolation in FastGPT deployments.

Affected Products

FastGPT versions 4.14.17 through 4.15.0-beta4
labring FastGPT knowledge-based AI application platform
Multi-tenant FastGPT deployments exposing the chat record API

Discovery Timeline

2026-07-15 - CVE-2026-61644 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61644

Vulnerability Analysis

The vulnerability is a cross-tenant authorization bypass in the FastGPT chat record API. The endpoint POST /api/core/chat/record/getCollectionQuote returns quote citations or full-text content from a knowledge base collection associated with a specific chat turn. FastGPT enforces access checks on the appId, chatId, chatItemDataId, and collectionId request parameters to confirm the caller owns the referenced chat and collection.

The initialId parameter, however, is used to look up the center node in the dataset graph without being validated against the caller's tenant scope. When an attacker supplies a valid combination of attacker-owned identifiers alongside a victim's dataset data id as initialId, the backend resolves and returns content tied to the foreign dataset. The response can include either quote metadata or the underlying full-text chunk depending on the query mode.

Root Cause

The root cause is missing authorization enforcement on a secondary object reference. The initial context check confirms ownership of the chat and collection objects but does not re-validate that initialId belongs to the same tenant or collection scope. This is a classic [CWE-863] Incorrect Authorization pattern where partial context validation creates a false trust boundary.

Attack Vector

Exploitation requires an authenticated low-privileged FastGPT tenant account and network access to the FastGPT API. The attacker crafts a valid request using their own appId, chatId, chatItemDataId, and collectionId, then substitutes a target tenant's dataset data id in the initialId field. The server returns dataset content that the attacker is not authorized to view. No user interaction on the victim side is required.

Source code details for the fix are available in FastGPT commit 0c1840c and Pull Request 7173.

Detection Methods for CVE-2026-61644

Indicators of Compromise

Requests to /api/core/chat/record/getCollectionQuote where the initialId value does not correspond to any dataset owned by the authenticated tenant.
Anomalous volumes of getCollectionQuote calls from a single account enumerating sequential or random initialId values.
Response payloads containing dataset content whose owning teamId differs from the authenticated caller's teamId in application logs.

Detection Strategies

Correlate FastGPT application logs with tenant ownership metadata to flag any response that returns dataset content outside the caller's tenant boundary.
Deploy an API gateway or WAF rule that inspects POST /api/core/chat/record/getCollectionQuote payloads and validates initialId against the caller's known dataset ids.
Baseline normal getCollectionQuote request rates per user and alert on statistical outliers indicative of enumeration.

Monitoring Recommendations

Enable verbose audit logging for all /api/core/chat/record/* endpoints, capturing the authenticated userId, teamId, and all input identifiers.
Forward FastGPT audit logs to a centralized SIEM to run cross-tenant access queries.
Track outbound data volumes from FastGPT to identify potential bulk exfiltration of dataset content.

How to Mitigate CVE-2026-61644

Immediate Actions Required

Upgrade FastGPT to version 4.15.0-beta5 or later, which contains the authorization fix.
Audit application logs from the introduction of version 4.14.17 forward for suspicious getCollectionQuote requests that reference unfamiliar initialId values.
Rotate or restrict access tokens for tenants suspected of malicious enumeration until log review is complete.

Patch Information

The vendor released the fix in FastGPT 4.15.0-beta5. Full details are published in the GitHub Security Advisory GHSA-mmg6-2g54-j896 and the v4.15.0-beta5 release notes. Administrators running self-hosted FastGPT should pull the updated container image or source tree and redeploy.

Workarounds

If patching is not immediately possible, block or filter POST /api/core/chat/record/getCollectionQuote at the reverse proxy or API gateway.
Restrict FastGPT tenant creation and require manual approval for new low-privileged accounts to reduce the attacker pool.
Segment sensitive datasets into separate FastGPT deployments so a single-instance authorization flaw cannot expose cross-customer content.

bash

# Example nginx snippet to block the vulnerable endpoint pending upgrade
location = /api/core/chat/record/getCollectionQuote {
    return 403;
}