hunt-benito/your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijackProof-of-concept exploit for CVE-2026-68929, demonstrating unauthenticated cross-tenant takeover of FastGPT WeChat channels via public shareId, including channel hijack and DoS.
| CVE | CVE-2026-68929 (CVSS 4.0 9.3 Critical) |
| Advisory | GHSA-q4pr-3qpg-9q5v |
| Affected | FastGPT >= 4.14.10, < 4.14.29 and >= 4.15.0, < 4.15.2 |
| Fixed | 4.14.29 and 4.15.2 (PR #7260) |
| CWE | CWE-862 (Missing Authorization), CWE-306 |
Three management endpoints under /api/support/outLink/wechat/ authorize
cross-tenant writes using nothing but the request-supplied shareId — the
identifier FastGPT prints into every shared-chat URL, iframe and embed:
logout — gated by authOutLinkValid, an existence check only, then
wipes the outLink's stored WeChat app.token and forces app.status
offline. Any anonymous caller with the public shareId kills a team's
channel in one request.qrcode/generate — same existence-only gate; returns an iLink login QR
cached under publish:wechat:qrcode:<shareId>.qrcode/status — no authorization call at all; when the QR is
confirmed it writes the scanner's bot_token / accountId / baseUrl
into the outLink identified by shareId and starts polling.Whoever scans the QR gets to choose the bot. Scan it with the attacker's WeChat and the victim team's app is bridged to the attacker's bot: private knowledge-base answers flow out and the victim's AI points pay for it.
Zero dependencies — Python 3 standard library only.
# 1. Fingerprint safely (nonexistent shareId; expect code 501 linkUnInvalid
# on vulnerable builds, an auth error on patched ones)
python3 poc.py probe --url http://localhost:3000
# 2. Collect a public shareId from a shared-chat link / iframe / embed
python3 poc.py harvest --target "https://victim.example/chat/share?shareId=XXXX"
python3 poc.py harvest --target saved-page.html
# 3. One-request DoS — wipes the channel binding
python3 poc.py dos --url http://localhost:3000 --share-id XXXX
# 4. Channel hijack — generates victim-qr.png; scan it with the ATTACKER's
# WeChat, the script polls until the binding flips
python3 poc.py hijack --url http://localhost:3000 --share-id XXXX
Deploy FastGPT from the repository's official compose template for the 4.15
line (deploy/version/v4.15/docker-compose.template.yml), pinning the image
to v4.15.1 (the last vulnerable release of that branch). Create an app,
publish it, add a WeChat outLink in the publish settings, then run probe /
dos / hijack against it. Completing a real iLink bot registration is not
required to observe the authorization defect — the anonymous reachability of
the mutating handlers is the bug.
For authorized testing and defense validation only. The fixed releases have been out since July 2026 — if you run FastGPT with the WeChat channel, upgrade to >= 4.15.2 (or >= 4.14.29) and re-bind any channel that lived through the exposure window.