CVE-2026-40352
NoSQL Injection in FastGPT Password Change Enables Account Takeover
Publication date: 2026-04-17
Last updated on: 2026-04-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fastgpt | fastgpt | to 4.14.9.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-943 | The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FastGPT versions prior to 4.14.9.5 in the password change endpoint. It is a NoSQL injection flaw that allows an authenticated attacker to bypass the verification of the "old password" by injecting MongoDB query operators.
As a result, an attacker with a low-privileged session can change the password of their own account or potentially other accounts (if combined with ID manipulation) without knowing the current password.
This leads to full account takeover and persistence.
How can this vulnerability impact me? :
The vulnerability allows an attacker with low privileges to take over accounts by changing passwords without knowing the original ones.
This can lead to unauthorized access, loss of account control, and potential persistence within the system.
The impact includes confidentiality, integrity, and availability being compromised, as indicated by the CVSS score (8.8) with high impact on all three.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade FastGPT to version 4.14.9.5 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated attacker to bypass password verification and potentially take over accounts, leading to unauthorized access and persistence.
Such unauthorized access and account takeover can result in breaches of confidentiality, integrity, and availability of user data.
This can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access.