Log in Start free

Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-55418FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

High 8.6

In plain English

A high-severity authorization bypass via user-controlled key in FastGPT from labring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 58.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.

Affected products (as reported)

VendorProductVersions
labring FastGPT < 4.15.0-beta5

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References