Description

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T21:17:49.120Z",
  "pubdate": "2026-08-31T21:17:49.120Z",
  "executiveSummary": "FastGPT Community Edition, versions 4.10.0 through 4.14.0, is affected by a critical NoSQL injection vulnerability within the /api/core/chat/getHistories endpoint.\nThe vulnerability arises from improper sanitization of user-supplied input, allowing an unauthenticated attacker to inject malicious NoSQL query operators into JSON payloads.\nThis flaw enables unauthorized access to sensitive data, specifically the chat history titles belonging to any user registered on the platform.\nThe risk is categorized as high, as it bypasses authorization mechanisms, leading to significant information disclosure.\nSuccessful exploitation requires no prior authentication, exposing the platform to unauthorized data retrieval across the entire user base.\nThe vulnerability impacts the integrity and confidentiality of user communications data within the affected FastGPT deployments.",
  "technicalDetails": "The vulnerability exists in the /api/core/chat/getHistories endpoint of the FastGPT Community Edition, specifically within the versions 4.10.0 through 4.14.0.\nThe root cause of this security flaw is the failure of the application to properly sanitize and validate input parameters when constructing database queries for the underlying NoSQL database engine.\nWhen the application receives a request at the /api/core/chat/getHistories endpoint, it processes the JSON payload to filter results by user identification or session attributes.\nBecause the application logic fails to distinguish between literal input and control operators, an attacker can manipulate the query structure by injecting MongoDB-style operators, such as '$ne' (not equal) or '$gt' (greater than), within the JSON payload.\nBy crafting a malicious payload, an attacker can effectively neutralize existing authorization checks that are intended to scope database queries to the requesting user's session.\nThe attack flow proceeds as follows: First, the attacker identifies the /api/core/chat/getHistories POST endpoint as the target for injection. Second, the attacker constructs a JSON object where typical string fields are replaced with NoSQL operator objects. For instance, if the backend expects a 'userId' field, the attacker replaces this with a query object designed to match all records rather than a single specific identifier.\nWhen this payload reaches the database driver, the injected operators are executed against the database, causing the engine to return a broader set of records than authorized.\nThis results in the application returning the chat history titles of all users across the entire system, rather than restricting the response to the context of a legitimate, authenticated user.\nThe impact is significant, as it facilitates mass unauthorized data harvesting through a single endpoint. The lack of authentication requirements at the protocol level means this vulnerability is reachable over any network path that can communicate with the FastGPT API service.\nFurthermore, because the injection occurs at the API layer, the database engine executes these commands with the privileges assigned to the database user account used by the application, potentially exposing the entire 'chat history' collection to the attacker without triggering standard access controls."
}