your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack

CVE-2026-68929 — Preuve de concept de détournement du canal WeChat FastGPT Détournement non authentifié et inter-tenant du canal de partage WeChat iLink de FastGPT, basé uniquement sur le shareId public. | ---|--- CVE| CVE-2026-68929 CVSS 4.0 9.3 Critique Avis de sécurité| GHSA-q4pr-3qpg-9q5v...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...