CVE-2026-79483: SQL Injection
Published Aug 31, 2026
·Updated
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
Affected Software
1 affected component
FastGPT Community Edition>=4.10.0<=4.14.0
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·09:17 PM
Description
Frequently Asked Questions
1
Which deployments are affected?
FastGPT Community Edition versions 4.10.0 through 4.14.0 are affected. The vulnerable endpoint is POST /api/core/chat/getHistories.
2
Does an attacker need an account or prior access?
No. The issue can be exploited by an unauthenticated attacker using a crafted JSON payload containing malicious NoSQL operators.
3
What information can be exposed through exploitation?
Successful exploitation bypasses authorization checks and allows unauthorized access to chat history titles for all users across the platform.