CVE-2026-54601: FastGPT Cross-Tenant Data Isolation Bypass (v4.14.17–4.15.0-beta3)

Technical summary

The vulnerability exists in the POST /api/core/dataset/collection/create/reTrainingCollection endpoint. When an authenticated tenant user submits a request, the endpoint can persist a datasetId value originating from a different tenant's context. This creates a "mixed" dataset object where the ownership anchor is misaligned with the actual tenant boundary. Downstream operations on dataset, collection, and training endpoints then reference this mixed object during authorization checks, leading to decisions based on the corrupted ownership information rather than the caller's authenticated tenant. This allows an attacker who knows or can enumerate dataset IDs from other tenants to perform cross-tenant read, update, and delete operations. The issue is rooted in CWE-915 (Improperly Controlled Multiple Levels of Privileges), where authorization decisions fail to consistently validate against the correct privilege boundary.

Business impact

Organizations deploying FastGPT in multi-tenant environments face data exposure and integrity risks. Tenant isolation is a foundational security boundary in SaaS platforms; compromise of this boundary allows one customer to access, modify, or destroy another customer's proprietary training data and knowledge bases. In scenarios where FastGPT hosts sensitive industry data, competitive intelligence, or regulated information, cross-tenant access could result in data breaches, compliance violations, intellectual property theft, and reputational damage. The attack requires only basic authentication and knowledge of target dataset IDs, making the threat model practical for motivated threat actors.

Affected systems

FastGPT versions 4.14.17 through 4.15.0-beta3 are affected. The issue is resolved in version 4.15.0-beta4 and later. Organizations running FastGPT in production should confirm their installed version and verify patch status against the official release notes. No evidence suggests the vulnerability affects other versions prior to 4.14.17, but users of any version within the affected range should prioritize upgrade planning.

Exploitability

Exploitability is moderate. The attacker must be an authenticated tenant user—they cannot exploit this as an unauthenticated outsider. However, once authenticated, the attack is straightforward: crafting a POST request to the vulnerable endpoint with a dataset ID from another tenant. No special tooling, race conditions, or user interaction is required. The primary barrier to exploitation is discovering or enumerating dataset IDs from target tenants, which may be feasible in environments with predictable ID patterns or if an attacker has partial visibility into the platform. CVSS 3.1 assigns a score of 6.3 (MEDIUM), reflecting the authentication requirement offset by the direct impact on confidentiality, integrity, and availability of peer tenant data.

Remediation

Upgrade FastGPT to version 4.15.0-beta4 or later. This patch version corrects the authorization logic to ensure dataset ownership is validated consistently against the calling tenant, preventing mixed dataset objects from being created or used in subsequent operations. Before upgrading, verify compatibility with your deployment environment and test in a staging instance. If immediate patching is not feasible, consider restricting access to the FastGPT platform to a smaller, trusted user population and implementing network-level access controls to limit who can reach the vulnerable endpoints.

Patch guidance

Verify your current FastGPT version by checking the release or version endpoint in your deployment. If running 4.14.17 through 4.15.0-beta3, plan an upgrade to 4.15.0-beta4 or later. Review the official FastGPT release notes and changelog to understand any breaking changes or new dependencies introduced in the patched version. Test the patch in a non-production environment first, including verification that multi-tenant data isolation is working as expected. After upgrade, confirm the fix by validating that the reTrainingCollection endpoint no longer accepts or persists cross-tenant dataset identifiers.

Detection guidance

Monitor for POST requests to /api/core/dataset/collection/create/reTrainingCollection endpoints with unusual or repeated calls that may indicate enumeration of dataset IDs. Log and review the datasetId values being submitted relative to the authenticated tenant context; a mismatch would indicate exploitation. Inspect application logs for any authorization errors or mixed dataset object warnings that might occur if an attacker attempts to use corrupted dataset references. Consider implementing or enabling audit trails that track dataset creation, modification, and deletion operations by tenant, and alert on cross-tenant operations. Network-level logging of API traffic patterns can help identify reconnaissance activity or bulk enumeration attempts.

Why prioritize this

This vulnerability should be prioritized for patching in multi-tenant FastGPT deployments because it directly undermines tenant isolation, a core security expectation in shared SaaS environments. The low barrier to exploitation (authentication + known dataset ID) combined with the severity of the impact (cross-tenant read, write, delete) justifies moving this above routine maintenance patches. Organizations hosting customer data or sensitive proprietary information in FastGPT should treat this as a high-priority security issue, even though the CVSS score is MEDIUM. Single-tenant deployments or air-gapped instances with restricted user access face lower practical risk but should still upgrade as part of normal patch management.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects a vulnerability with low attack complexity, requiring only network access and valid authentication (PR:L), with no user interaction. The scope is unchanged (tenant data remains within the system boundary), but the confidentiality, integrity, and availability impacts are all classified as low in CVSS terms because the impact is bounded to peer tenant data within the same system rather than arbitrary system compromise. However, the practical business risk is elevated due to the nature of the violation (tenant isolation breach), the ease of discovery and exploitation once a tenant credential is obtained, and the sensitive nature of knowledge bases and training data that FastGPT often hosts. Security teams should treat the business risk as higher than the numerical score alone suggests.

Frequently asked questions