CVE-2026-61644

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collectionId values while supplying another tenant's dataset data id as initialId, causing the response to include foreign dataset quote or full-text content. This issue is fixed in version 4.15.0-beta5.

• CWE-863

• https://github.com/labring/FastGPT/commit/0c1840c7773c5be5d777f86228651479e02155db
• https://github.com/labring/FastGPT/pull/7173
• https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5
• https://github.com/labring/FastGPT/security/advisories/GHSA-mmg6-2g54-j896
• https://github.com/labring/FastGPT/security/advisories/GHSA-mmg6-2g54-j896

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61638Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-61639Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-6164A security flaw has been discovered in code-projects Lost an…7.3
• CVE-2026-61640Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-61641Wallos is an open-source, self-hostable personal subscriptio…8.1
• CVE-2026-61643FastGPT is a knowledge-based AI application platform. From 4…5.9
• CVE-2026-61646FastGPT is a knowledge-based AI application platform. Prior …6.3
• CVE-2026-61647NotebookLM MCP is an MCP server and HTTP service for interac…7.1
• CVE-2026-6165A weakness has been identified in code-projects Vehicle Show…7.3
• CVE-2026-61652Zapros, a Python HTTP client, prior to version 0.14.0 is vul…8.7
• CVE-2026-6166A security vulnerability has been detected in code-projects …7.3
• CVE-2026-61663django CMS is an easy-to-use and developer-friendly enterpri…4.3