CVE-2026-61684: FastGPT = 4.15.0-beta4

Affected technology

FastGPT · = 4.15.0-beta4
labring

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can self-sign an HS256 JWT and reach /api/invoke/userInfo to disclose cross-tenant user PII by attacker-supplied tmbId values, or /api/invoke/fileUpload to write attacker-controlled content into chat files. Vendor/CNA’s CVSS 4.0 assessment (base score 8.8/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.