CVE-2026-61644

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collectionId values while supplying another tenant's dataset data id as initialId, causing the response to include foreign dataset quote or full-text content. This issue is fixed in version 4.15.0-beta5.

• CWE-863

• https://github.com/labring/FastGPT/commit/0c1840c7773c5be5d777f86228651479e02155db
• https://github.com/labring/FastGPT/pull/7173
• https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5
• https://github.com/labring/FastGPT/security/advisories/GHSA-mmg6-2g54-j896
• https://github.com/labring/FastGPT/security/advisories/GHSA-mmg6-2g54-j896

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61613Cursor is a code editor built for programming with AI. Prior…7.7
• CVE-2026-6162A vulnerability has been found in PHPGurukul Company Visitor…3.5
• CVE-2026-6163A vulnerability was identified in code-projects Lost and Fou…7.3
• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3
• CVE-2026-6164A security flaw has been discovered in code-projects Lost an…7.3
• CVE-2026-61643FastGPT is a knowledge-based AI application platform. From 4…5.9
• CVE-2026-61646FastGPT is a knowledge-based AI application platform. Prior …6.3
• CVE-2026-6165A weakness has been identified in code-projects Vehicle Show…7.3
• CVE-2026-6166A security vulnerability has been detected in code-projects …7.3
• CVE-2026-6167A vulnerability was detected in code-projects Faculty Manage…7.3
• CVE-2026-6168A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. …8.8
• CVE-2026-61684FastGPT is a knowledge-based AI application platform. In 4.1…8.8