CyberRota Analysis
AI-GeneratedFastGPT versions prior to 4.15.0 are vulnerable to an improper access control issue that allows authenticated users to access and read another team's prompts and response traces by exploiting known request IDs. This can lead to unauthorized data exposure, compromising sensitive information across teams. Organizations using FastGPT should prioritize upgrading to version 4.15.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known. This issue is fixed in version 4.15.0.