CVE-2026-54601 Details
Description
FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticated tenant user to call POST /api/core/dataset/collection/create/reTrainingCollection in a way that persists a server-owned datasetId value from another tenant. This creates mixed dataset objects and downstream dataset, collection, and training endpoints then make authorization decisions from inconsistent ownership anchors, allowing cross-tenant read, update, and delete access when mixed object ids are known. This issue is fixed in version 4.15.0-beta4.
A vulnerability in FastGPT versions 4.14.17 prior to 4.15.0-beta4 allows authenticated users to manipulate dataset ownership through the reTrainingCollection API. This results in unauthorized cross-tenant access to data and training resources. The issue arises when a user can submit a dataset ID from another tenant, creating mixed ownership scenarios that disrupt authorization processes. Consequently, users can access, modify, or delete data linked to collections from different tenants, leading to potential integrity violations.
Users can update to FastGPT version 4.15.0-beta4 or later, where this vulnerability is fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/labring/FastGPT/security/advisories/GHSA-qxcq-48gr-93pj | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/labring/FastGPT/commit/54a53e7d4399f1dfa2913394442c3cf6de672fb3 | [email protected] | Source CodeVendor |
| https://github.com/labring/FastGPT/pull/7071 | [email protected] | Source CodeVendor |
| https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta4 | [email protected] | Release NotesVendor |
| https://github.com/labring/FastGPT/security/advisories/GHSA-qxcq-48gr-93pj | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| labring/FastGPT | >= 4.14.17, < 4.15.0-beta4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |