medium5.3
CVE-2026-79483
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.
Impact
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
Affected products
| Product | Affected versions |
|---|---|
| FastGPT Community Edition 4.10.0 | through 4.14.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.