CVE-2026-61643

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61643", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-10T17:38:57.112Z", "datePublished": "2026-07-15T17:03:22.325Z", "dateUpdated": "2026-07-20T14:32:04.031Z"}, "containers": {"cna": {"title": "FastGPT: workflow runtime can execute another user's private HTTP toolset", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch"}, {"name": "https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5", "tags": ["x_refsource_MISC"], "url": "https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5"}], "affected": [{"vendor": "labring", "product": "FastGPT", "versions": [{"version": ">= 4.14.17, < 4.15.0-beta5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T17:03:22.325Z"}, "descriptions": [{"lang": "en", "value": "FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5."}], "source": {"advisory": "GHSA-93r3-wqq3-c5ch", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T14:31:52.902899Z", "id": "CVE-2026-61643", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T14:32:04.031Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61643", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T14:31:52.902899Z"}}}], "references": [{"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T14:31:37.276Z"}}], "cna": {"title": "FastGPT: workflow runtime can execute another user's private HTTP toolset", "source": {"advisory": "GHSA-93r3-wqq3-c5ch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "labring", "product": "FastGPT", "versions": [{"status": "affected", "version": ">= 4.14.17, < 4.15.0-beta5"}]}], "references": [{"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch", "name": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5", "name": "https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T17:03:22.325Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61643", "state": "PUBLISHED", "dateUpdated": "2026-07-20T14:32:04.031Z", "dateReserved": "2026-07-10T17:38:57.112Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-15T17:03:22.325Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FastGPT", "vendor": "labring", "versions": [{"status": "affected", "version": ">= 4.14.17, < 4.15.0-beta5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5."}, {"lang": "es", "value": "FastGPT es una plataforma de aplicaci\u00f3n de IA basada en conocimiento. Desde la versi\u00f3n 4.14.17 hasta la 4.15.0-beta5, un usuario autenticado de FastGPT puede guardar un nodo de flujo de trabajo que apunta al conjunto de herramientas HTTP privado de otro usuario utilizando un ID de herramienta guardado manipulado, como http-[victim_toolset_app_id]/[tool_name]. Las rutas normales del conjunto de herramientas deniegan el acceso, pero la ruta de guardado y tiempo de ejecuci\u00f3n del flujo de trabajo no aplic\u00f3 la misma comprobaci\u00f3n de autorizaci\u00f3n al conjunto de herramientas referenciado, permitiendo que /API/v2/chat/completions resolviera la referencia guardada y ejecutara la herramienta HTTP propiedad de la v\u00edctima. Este problema est\u00e1 solucionado en la versi\u00f3n 4.15.0-beta5."}], "id": "CVE-2026-61643", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61643", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T14:31:52.902899Z", "version": "2.0.3"}}]}, "published": "2026-07-15T18:16:49.510", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5"}, {"source": "security-advisories@github.com", "url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/labring/FastGPT/security/advisories/GHSA-93r3-wqq3-c5ch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.17,4.15.0-beta5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FastGPT", "source": "cna", "vendor": "labring"}, "product": "fastgpt", "vendor": "labring"}], "created": "2026-07-15T22:45:04.767542+00:00", "updated": "2026-08-03T03:15:05.915370+00:00", "vendors": ["labring", "labring$PRODUCT$fastgpt"]}