CVE-2026-55418

{
  "id": "CVE-2026-55418",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-07T22:16:53.930",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5."
    },
    {
      "lang": "es",
      "value": "FastGPT es una plataforma de base de conocimiento de IA de código abierto. Antes de la v4.15.0-beta5, dos manejadores de archivos de FastGPT autorizan un recurso no relacionado y luego firman o leen un objeto S3 utilizando una clave tomada directamente de la solicitud, sin verificar que la clave pertenezca al equipo del solicitante. Debido a que las claves de objeto S3 son globales dentro del bucket y llevan el ID de inquilino solo como un segmento de ruta, un atacante puede proporcionar la clave de otro equipo y obtener el contenido de su archivo a través del endpoint de prefirma de chat-file o el endpoint de vista previa de conjunto de datos. Este problema se solucionó en la versión v4.15.0-beta5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "labring",
          "product": "FastGPT",
          "versions": [
            {
              "version": "< 4.15.0-beta5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T14:38:04.939492Z",
          "id": "CVE-2026-55418",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/labring/FastGPT/commit/decb6d2fb1417fb9e2bca145d2dcc9cbcf06396c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/labring/FastGPT/pull/7104",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/labring/FastGPT/security/advisories/GHSA-6rxv-p43w-mmx5",
      "source": "[email protected]"
    }
  ]
}