CVE-2026-40352
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.38%
- CWE
- CWE-943
- Published
- 2026-04-17
- Last modified
- 2026-04-20
Affected products
- labring FastGPT
Weakness type
Related vulnerabilities
- CVE-2026-82060 — Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
- CVE-2026-62906 — Microsoft Discovery Studio Information Disclosure Vulnerability
- CVE-2026-85167 — n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
- CVE-2026-63138 — Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure
- CVE-2026-78691 — Unescaped backslash allows LIKE wildcard injection in AshSql string search
- CVE-2026-77846 — JSON path injection via unescaped get_path segments in AshSqlite
- CVE-2026-81528 — NoSQL injection via array replacement bypassing update shape validation in driver write path
- CVE-2026-81527 — NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation