VYPR
← All advisories
High severity8.1NVD Advisory· Published Apr 10, 2026· Updated Apr 21, 2026

CVE-2026-40252

CVE-2026-40252

Description

FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team. This leads to cross-tenant data exposure and unauthorized execution of private AI workflows. This vulnerability is fixed in 4.14.10.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Labring/Fastgpt2 versions
    cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:*range: <4.14.10.4
    • (no CPE)range: <=4.14.10.4

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.