NoSQL Injection Vulnerability in FastGPT Community Edition
CVE-2026-79483

5.3MEDIUM

Key Information:

Vendor

Labring

Status
FastGPT Community Edition
Vendor
CVE Published:
31 August 2026

What is CVE-2026-79483?

FastGPT Community Edition versions 4.10.0 to 4.14.0 are susceptible to a NoSQL injection on the POST /api/core/chat/getHistories endpoint. This vulnerability allows unauthenticated attackers to exploit crafted JSON payloads that inject malicious NoSQL operators, bypassing authorization checks. Consequently, attackers can access chat history titles across all users, compromising user privacy and data integrity. The threat underscores the importance of implementing robust input validation and authorization mechanisms to safeguard sensitive information.

References

https://github.com/labring/FastGPT
https://github.com/ExploreIO/CVE-2026-79483-FastGPT-NoSQL...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.