VULNERABILITY INTELLIGENCE
CVE-2026-79483
CVSS score5.3 MEDIUM
EPSS probability0.40%
CISA KEVNot currently listed
Published2026-08-31
Last modified2026-09-01
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-943