CVE-2026-55418: FastGPT Authorization Bypass Allows Unauthorized File Access Across Teams

Technical summary

The vulnerability stems from authorization logic that decouples resource verification from S3 object access. When processing requests to presign or preview files, FastGPT retrieves and validates an S3 resource reference but then uses an S3 key taken directly from the request parameter without re-verifying ownership. Because S3 keys are globally scoped within the bucket and only carry tenant identity as a path component, an unauthenticated or cross-tenant attacker can supply any valid S3 key and trigger legitimate file operations on unowned objects. This is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a authorization-by-reference flaw. The attack surface spans two endpoints: the chat-file presign handler (which generates signed URLs) and the dataset preview handler (which reads file contents directly).

Business impact

Unauthorized disclosure of confidential team data, including training datasets, proprietary documents, and chat histories stored in FastGPT instances. Multi-tenant deployments face the highest risk, as attackers can systematically enumerate and exfiltrate data from all teams within a single bucket. This compromises data privacy, regulatory compliance (GDPR, HIPAA, etc.), and customer trust. Organizations relying on FastGPT for sensitive knowledge management face potential notification obligations and remediation costs.

Affected systems

All FastGPT instances running versions prior to v4.15.0-beta5 are vulnerable. The impact is most severe in multi-tenant environments where multiple teams or organizations share the same S3 bucket. Single-tenant deployments with private S3 buckets face reduced but non-zero risk if bucket policies or IAM roles are misconfigured. Both the chat-file presign and dataset preview endpoints are affected.

Exploitability

Exploitation requires no authentication, no user interaction, and no special network access—only the ability to make HTTP requests to the FastGPT instance. An attacker must know or guess valid S3 object keys belonging to target teams; in practice, keys often follow predictable naming conventions (e.g., team-id/file-hash) or can be inferred from error messages or logs. The attack is trivial to automate and scale. CVSS 8.6 (HIGH) reflects the combination of network-based unauthenticated access, low attack complexity, and high confidentiality impact.

Remediation

Update FastGPT to v4.15.0-beta5 or later. This version implements proper ownership validation, ensuring that S3 keys are checked against the caller's team identifier before any presign or read operation. For instances unable to upgrade immediately, restrict S3 bucket access policies to the FastGPT service role and disable public or cross-account access. Monitor access logs for unusual key patterns or cross-team requests.

Patch guidance

Deploy v4.15.0-beta5 or a later stable release. Verify the patched version is running by checking the application version endpoint or build metadata. Test the patch in a staging environment to confirm file access is properly scoped to the requesting team. After upgrade, audit S3 bucket policies and IAM roles to ensure no overly permissive access remains. Restart all FastGPT services to ensure the fix is active.

Detection guidance

Look for HTTP requests to /chat-file/presign or dataset preview endpoints with S3 keys that do not match the requesting team's ID in the path. Monitor S3 access logs for GetObject or ListObject operations initiated by the FastGPT service role on keys from multiple teams in a short time window. Check audit logs for failed authorization events if FastGPT logs such events. Alert on any presign request where the response key differs from the request key, indicating a potential authorization bypass.

Why prioritize this

This vulnerability combines unauthenticated remote access, zero attack complexity, and guaranteed confidentiality impact across multiple endpoints. Multi-tenant FastGPT deployments handling sensitive data should treat this as critical and prioritize patching immediately. Even single-tenant instances should update within days, as the fix is stable and the attack surface is well-defined.

Risk score, explained

CVSS 8.6 reflects a HIGH-severity vulnerability: Network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), scope changed (S:C—cross-tenant impact), and high confidentiality loss (C:H). Integrity and availability are not impacted because the vulnerability only permits reading, not modifying or deleting files. The HIGH rating appropriately captures the severity of unauthorized data disclosure across team boundaries in multi-tenant systems.

Frequently asked questions