CyberRota Analysis
AI-GeneratedFastGPT Community Edition versions 4.10.0 to 4.14.0 are susceptible to a NoSQL injection vulnerability in the POST /api/core/chat/getHistories endpoint, allowing unauthenticated attackers to exploit crafted JSON payloads. This flaw enables attackers to bypass authorization checks and gain unauthorized access to the chat history titles of all users. Organizations using these versions should prioritize remediation to protect user data and maintain platform integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.