CVE-2026-40352

Published: Apr 17, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.

Affected (1)

Products: Fastgpt: Fastgpt

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fastgpt Fastgpt	Before 4.14.9.5

Related CWEs

Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

References (3)

https://github.com/labring/FastGPT/commit/bd966d479fbe414d02679cf79f9eaaab3d100a2d

Source: security-advisories@github.com

Patch

https://github.com/labring/FastGPT/releases/tag/v4.14.9.5

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/labring/FastGPT/security/advisories/GHSA-422w-vrfj-72g6

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.