exploreio/cve-2026-79483-fastgpt-nosql-injectionProof-of-concept for CVE-2026-79483, a NoSQL injection in FastGPT Community Edition allowing unauthenticated access to chat history titles. Includes reproduction steps and analysis.
| Field | Details |
|---|
| CVE ID | CVE-2026-79483 |
| Affected Product | FastGPT (Community Edition) |
| Affected Versions | >= 4.10.0 and <= 4.14.0 |
| Vulnerability Type | CWE-943: Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection) |
| Attack Vector | Remote / No authentication required |
| Impact | Information Disclosure |
| Patched Version | >= 4.15.0 |
| Root Cause | Community-edition authOutLinkInit() bypasses runtime type validation |
In FastGPT Community Edition versions 4.10.0 through 4.14.0, the POST /api/core/chat/getHistories endpoint contains a NoSQL injection vulnerability. An unauthenticated attacker can inject NoSQL operators ($ne, $regex, $gt, etc.) via a crafted JSON payload to bypass the outLink permission check, thereby gaining unauthorized access to the chat history titles of all users across the entire platform.
For detailed vulnerability reproduction, see
Chinese
English
This proof of concept is provided for educational and authorized security testing purposes only. The author assumes no responsibility for any misuse of this information. Always obtain proper authorization before testing any system.
