CVE-2026-54602 is an authorization bypass vulnerability in labring's FastGPT platform affecting versions before 4.15.0. The vulnerability arises because the GET /api/core/ai/record/getRecord API endpoint authenticates the caller but does not enforce team-based access control when loading LLM request and response traces by requestId. Consequently, any authenticated user who knows a requestId can retrieve sensitive data such as prompts, retrieved RAG chunks, and completions from other teams. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The issue is fixed in FastGPT version 4.15.0.

An attacker with valid authentication credentials can access confidential AI request and response data from other teams, potentially exposing sensitive prompts and retrieved information. This compromises data confidentiality within the platform. There is no indication of privilege escalation or impact beyond unauthorized data disclosure. No known exploits are reported in the wild.

Upgrade FastGPT to version 4.15.0 or later, where this authorization bypass vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated but the fix is included in version 4.15.0.