Unsecured WeChat Sharing in FastGPT by LabRing
CVE-2026-68929

9.3CRITICAL

Key Information:

Vendor

Labring

Status
Fastgpt
Vendor
CVE Published:
27 August 2026

What is CVE-2026-68929?

FastGPT, an open-source LLM platform developed by LabRing, has a critical authorization flaw in its WeChat (iLink) share-channel endpoints prior to version 4.15.2. The vulnerability allows unauthenticated attackers who possess a team's shareId to manipulate the team's WeChat bot. Without any validation checks for authenticated identity or team ownership, attackers can take control of the bot or disable it entirely. This can be achieved through endpoints that do not require proper authorization, enabling attackers to overwrite stored WeChat tokens and bind their bots to victim teams. Consequently, they can view private responses and exhaust the resources of the legitimate application. The issue has been resolved in version 4.15.2.

Affected Version(s)

FastGPT >= 4.14.10, < 4.14.29 < 4.14.10, 4.14.29

FastGPT >= 4.15.0, < 4.15.2 < 4.15.0, 4.15.2

References

https://github.com/labring/FastGPT/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/labring/FastGPT/commit/81d391995b1f998...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.