CVE-2026-68929: FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated attacker who knows a victim team's shareId can take that team's WeChat bot offline or hijack the channel to their own bot: the logout endpoint is gated only by an existence check yet wipes the outLink's stored WeChat token, and the QR-code status endpoint performs no authorization at all and writes attacker-supplied bot credentials into the outLink identified by shareId. By generating a QR for a victim shareId, scanning it with their own WeChat, and calling the status endpoint, an attacker binds the victim team's app to the attacker's bot, exposing the app's private responses, displacing the legitimate binding, and consuming the victim's resources. The shareId is exposed in every shared chat URL, iframe, and embed, so it is not a secret. This issue is fixed in version 4.15.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FastGPTto a version that resolves this vulnerability.Fixed in 4.15.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Teams using FastGPT versions earlier than 4.15.2 with a WeChat (iLink) share channel are exposed. The required shareId is publicly exposed in shared chat URLs, iframes, and embeds, so it should not be treated as an access secret.
What does an attacker need to exploit the flaw?
An attacker only needs the victim team's shareId and does not need to authenticate or prove team ownership. They can log out the channel to erase its stored WeChat token, or generate a QR code for the shareId and bind the app to their own WeChat bot.
What is the impact of a successful channel takeover?
The attacker can displace the legitimate WeChat binding and direct the victim team's application to the attacker's bot. This can expose the application's private responses to the attacker and consume the victim team's resources; clearing the stored token can also take the bot offline.
What should teams do if they cannot upgrade immediately?
The provided information identifies version 4.15.2 as the fix but does not document a workaround. Until upgraded, treat exposed shareIds as insufficient protection and consider disabling affected WeChat share-channel functionality where operationally feasible.