漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT
Vulnerability Description
FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify that the requested application belongs to the authenticated team. This leads to cross-tenant data exposure and unauthorized execution of private AI workflows. This vulnerability is fixed in 4.14.10.4.
CVSS Information
N/A
Vulnerability Type
访问控制不恰当
Vulnerability Title
FastGPT 安全漏洞
Vulnerability Description
FastGPT是labring开源的一款基于大语言模型的开源知识库问答系统。 FastGPT 4.14.10.4之前版本存在安全漏洞，该漏洞源于访问控制不当，任何经过身份验证的团队通过提供外部appId即可访问和执行属于其他团队的应用程序，可能导致跨租户数据暴露和未经授权的私有AI工作流执行。
CVSS Information
N/A
Vulnerability Type
N/A