CVE-2026-68929: CWE-862: Missing Authorization in labring FastGPT
Description
FastGPT versions prior to 4.15.2 have a missing authorization vulnerability in the WeChat (iLink) share-channel endpoints. These endpoints rely solely on a public shareId for authorization, which is exposed in shared URLs and embeds, allowing unauthenticated attackers to hijack or disrupt victim teams' WeChat bots. Attackers can log out the victim's bot or bind the victim's app to their own bot, exposing private responses and consuming victim resources. This issue is fixed in version 4.15.2.
CVSS v4.0
Score 9.3critical
Affected software
labring
FastGPT
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-68929 describes a missing authorization vulnerability (CWE-862) in labring FastGPT's WeChat share-channel endpoints prior to version 4.15.2. The endpoints authorize requests using only the public shareId without verifying authenticated identity or team ownership. This allows unauthenticated attackers who know a victim team's shareId to take the team's WeChat bot offline by wiping stored tokens or hijack the channel by binding the victim's app to the attacker's bot. The shareId is publicly exposed in shared URLs, making exploitation feasible. The vulnerability is addressed in FastGPT version 4.15.2.
Potential Impact
An unauthenticated attacker can disrupt a victim team's WeChat bot by logging it out or hijack the bot channel to their own, exposing private app responses and displacing legitimate bindings. This leads to resource consumption by the victim and potential data exposure. The vulnerability affects confidentiality, integrity, and availability of the affected FastGPT WeChat integration.
Mitigation Recommendations
Upgrade FastGPT to version 4.15.2 or later, where this missing authorization issue is fixed. There is no indication of alternative mitigations or temporary fixes. Patch status is not explicitly stated but the vendor fixed the issue in 4.15.2, so applying this update is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-31T21:49:24.927Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a916b39acd9273b49cabdcb
Added to database: 08/28/2026, 11:04:25 UTC
Last enriched: 09/08/2026, 09:22:09 UTC
Last updated: 10/12/2026, 06:48:18 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.