Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-54601
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-07 Jul, 2026 | 21:16
Updated At-08 Jul, 2026 | 13:53
Rejected At-
▼CVE Numbering Authority (CNA)
FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion

FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticated tenant user to call POST /api/core/dataset/collection/create/reTrainingCollection in a way that persists a server-owned datasetId value from another tenant. This creates mixed dataset objects and downstream dataset, collection, and training endpoints then make authorization decisions from inconsistent ownership anchors, allowing cross-tenant read, update, and delete access when mixed object ids are known. This issue is fixed in version 4.15.0-beta4.

Affected Products
Vendor
Labring Computing Co., LTD.labring
Product
FastGPT
Versions
Affected
  • >= 4.14.17, < 4.15.0-beta4
Problem Types
TypeCWE IDDescription
CWECWE-915CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Type: CWE
CWE ID: CWE-915
Description: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Metrics
VersionBase scoreBase severityVector
3.16.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Version: 3.1
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/labring/FastGPT/security/advisories/GHSA-qxcq-48gr-93pj
x_refsource_CONFIRM
https://github.com/labring/FastGPT/pull/7071
x_refsource_MISC
https://github.com/labring/FastGPT/commit/54a53e7d4399f1dfa2913394442c3cf6de672fb3
x_refsource_MISC
https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta4
x_refsource_MISC
Hyperlink: https://github.com/labring/FastGPT/security/advisories/GHSA-qxcq-48gr-93pj
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/labring/FastGPT/pull/7071
Resource:
x_refsource_MISC
Hyperlink: https://github.com/labring/FastGPT/commit/54a53e7d4399f1dfa2913394442c3cf6de672fb3
Resource:
x_refsource_MISC
Hyperlink: https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta4
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/labring/FastGPT/security/advisories/GHSA-qxcq-48gr-93pj
exploit
Hyperlink: https://github.com/labring/FastGPT/security/advisories/GHSA-qxcq-48gr-93pj
Resource:
exploit
Details not found