CVE-2026-68929

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.2

Description WeChat (iLink) share-channel endpoints authorize requests using only the public shareId without verifying authenticated identity or team ownership. Because the shareId is exposed in shared chat URLs, iframes, and embeds, an unauthenticated attacker can use it to disrupt or hijack a team's WeChat bot. Specifically, the logout endpoint only checks for the existence of the ID before wiping the stored WeChat token, and the QR-code status endpoint allows an attacker to write their own bot credentials into the outLink identified by the shareId. This allows an attacker to bind a victim team's application to their own bot, leading to the exposure of private responses, displacement of the legitimate binding, and consumption of the victim's resources.

Recommendations Update to version 4.15.2.