CVE-2026-54601

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.17 through 4.15.0-beta3

Description An authenticated tenant user can call the 'POST /api/core/dataset/collection/create/reTrainingCollection' endpoint to persist a datasetId value belonging to another tenant. This results in the creation of mixed dataset objects, causing subsequent dataset, collection, and training endpoints to make authorization decisions based on inconsistent ownership anchors. Consequently, this allows unauthorized cross-tenant read, update, and delete access if the mixed object IDs are known.

Recommendations Update to version 4.15.0-beta4.