CVE-2026-40352
FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.
| CWE | CWE-943 |
| Vendor | labring |
| Product | fastgpt |
| Published | Apr 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for labring fastgpt
Be the first to know when new high vulnerabilities affecting labring fastgpt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
labring / FastGPT
< 4.14.9.5