CVE-2026-79483: n/a

CVE-2026-79483 describes a NoSQL injection vulnerability affecting FastGPT Community Edition versions 4.10.0 through 4.14.0. The vulnerability exists in the POST /api/core/chat/getHistories endpoint, where insufficient input validation allows unauthenticated attackers to inject malicious NoSQL operators within JSON payloads. This injection bypasses authorization mechanisms, enabling unauthorized disclosure of chat history titles across all users. The vulnerability is categorized under CWE-943 (Improper Neutralization of Special Elements used in an Injection). No known exploits are reported in the wild, and no vendor remediation or patch is currently documented.

An attacker can bypass authorization controls without authentication and access chat history titles of all users on the platform. This results in unauthorized disclosure of potentially sensitive metadata related to user communications. There is no indication of integrity or availability impact. The medium CVSS score reflects the confidentiality impact without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint where possible and monitor for suspicious requests attempting NoSQL injection patterns. Avoid exposing the vulnerable API publicly if feasible.