High severity8.1NVD Advisory· Published Apr 10, 2026· Updated Apr 21, 2026
CVE-2026-40252
CVE-2026-40252
Description
FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team. This leads to cross-tenant data exposure and unauthorized execution of private AI workflows. This vulnerability is fixed in 4.14.10.4.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/labring/FastGPT/security/advisories/GHSA-gc8m-w37w-24hwnvdVendor Advisory
- github.com/labring/FastGPT/releases/tag/v4.14.10.4nvdRelease Notes
News mentions
0No linked articles in our index yet.