CVE-2026-68929

FastGPT, an open-source LLM platform for building knowledge-base AI applications, authorizes its WeChat (iLink) share-channel endpoints using only the public shareId, with no authenticated identity or team-ownership check (CWE-306/CWE-862). Because the shareId is exposed in every shared chat URL, iframe, and embed, an unauthenticated attacker who learns it can call the logout endpoint — which only checks existence before wiping the stored WeChat token — to take a victim team's WeChat bot offline, or generate a QR code for the victim's shareId, scan it with their own WeChat, and call the QR-code status endpoint, which performs no authorization and writes attacker-supplied bot credentials into the victim's outLink. The result is that the victim team's app becomes bound to the attacker's bot, exposing the app's private chat responses, displacing the legitimate binding, and consuming the victim's resources. All FastGPT deployments running versions prior to 4.15.2 that use the WeChat (iLink) share channel are affected. There is no known in-the-wild exploitation: EPSS is 0.3%, no public proof-of-concept exists, and the issue is not in CISA KEV.

What to do: Upgrade FastGPT to version 4.15.2 or later. Until upgraded, treat shareIds as semi-public knowledge: check each team's outLink for unexpected WeChat bot bindings or wiped tokens, re-bind the legitimate bot and regenerate shareIds where tampering is found, and avoid embedding shared chats on untrusted pages.