your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack

CVE-2026-68929 — FastGPT WeChat 채널 하이재킹 PoC 인증되지 않은, 크로스 테넌트 방식의 FastGPT WeChatiLink 공유 채널 탈취로, 공개된shareId 만으로 가능합니다...

CVE-2026-68929

FastGPT , an open-source LLM platform, is vulnerable to unauthenticated WeChat channel hijack and denial of service in versions prior to 4.15.2 . The WeChat (iLink) share-channel endpoints authorize requests using only the publicly exposed shareId , with no authenticated identity or team-ownershi...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

PT-2026-82775

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.2 Description WeChat iLink share-channel endpoints authorize requests using only the public shareId without verifying authenticated identity or team ownership. Because the shareId is exposed in shared chat URLs,...