{"id":"CVE-2026-61643","aliases":["EUVD-2026-44753","GHSA-93r3-wqq3-c5ch"],"status":"published","title":"FastGPT: workflow runtime can execute another user's private HTTP toolset","description":"FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-\u003cvictim_toolset_app_id\u003e/\u003ctool_name\u003e. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00193,"percentile":0.09058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-07-15T17:03:22Z","modified":"2026-10-28T02:30:25Z","products":[{"vendor":"labring","product":"fastgpt"}],"references":[{"url":"https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61643.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61643","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-61643","title":"FastGPT: workflow runtime can execute another user's private HTTP toolset","description":"FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-\u003cvictim_toolset_app_id\u003e/\u003ctool_name\u003e. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.","status":"published","published":"2026-07-15T17:03:22.325Z","modified":"2026-07-20T14:32:04.031Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-44753","description":"FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-\u003cvictim_toolset_app_id\u003e/\u003ctool_name\u003e. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.","status":"published","published":"2026-07-15T17:03:22Z","modified":"2026-07-20T14:32:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"nvd":[{"id":"CVE-2026-61643","description":"FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-\u003cvictim_toolset_app_id\u003e/\u003ctool_name\u003e. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.","status":"published","published":"2026-07-15T18:16:49.51Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-61643","title":"FastGPT: workflow runtime can execute another user's private HTTP toolset","description":"FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-\u003cvictim_toolset_app_id\u003e/\u003ctool_name\u003e. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.","status":"published","published":"2026-07-15T17:03:22.325Z","modified":"2026-10-28T02:30:25.898368581Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:12.933503Z"}]}}