CVE-2026-40352

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.

• CWE-943

• https://github.com/labring/FastGPT/commit/bd966d479fbe414d02679cf79f9eaaab3d100a2dPatch
• https://github.com/labring/FastGPT/releases/tag/v4.14.9.5Product, Release Notes
• https://github.com/labring/FastGPT/security/advisories/GHSA-422w-vrfj-72g6Exploit, Vendor Advisory

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40347Python-Multipart is a streaming multipart parser for Python.…5.3
• CVE-2026-40348Movary is a self hosted web app to track and rate a user's w…7.7
• CVE-2026-40349Movary is a self hosted web app to track and rate a user's w…8.8
• CVE-2026-4035A vulnerability in mlflow/mlflow versions prior to 3.11.0 al…7.7
• CVE-2026-40350Movary is a self hosted web app to track and rate a user's w…8.8
• CVE-2026-40351FastGPT is an AI Agent building platform. In versions prior …9.8
• CVE-2026-40353wger is a free, open-source workout and fitness manager. In …5.4
• CVE-2026-40354Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1…6.3
• CVE-2026-40355In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL …7.5
• CVE-2026-40356In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an inte…7.5
• CVE-2026-40357Deserialization of untrusted data in Microsoft Office ShareP…8.8
• CVE-2026-40358Heap-based buffer overflow in Microsoft Office allows an una…8.4