CVE-2026-40252CWE-284CWE-639

Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT

Medium · published April 10, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team. This leads to cross-tenant data exposure and unauthorized execution of private AI workflows. This vulnerability is fixed in 4.14.10.4.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00441 · 37.3th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-10T20:52Z
EPSS history
Timeline
  • 10 APR 20:52Z
    Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT
    cvelistv5