id: CVE-2026-68929

info:
  name: "FastGPT - Missing Authorization"
  author: vedas-arpsyndicate
  severity: high
  description: |
    FastGPT prior to 4.15.2 authorizes its WeChat (iLink) share-channel endpoints under
    /api/support/outLink/wechat/ using only the public shareId, with no authenticated identity or
    team-ownership check. An unauthenticated attacker who knows a victim team's shareId (exposed in every
    shared chat URL, iframe and embed) can take the WeChat bot offline via the logout endpoint or hijack
    the channel to their own bot via the QR-code status endpoint. This template sends a benign request with
    a random, non-existent shareId; a vulnerable build reaches the share-link lookup without any
    authentication challenge and returns the invalid-link response, whereas a patched build rejects the
    request with an authentication error.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-68929&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=fastgpt&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.3
    cve-id: CVE-2026-68929
    cwe-id: CWE-862
  metadata:
    verified: false
  tags: cve,cve2026,fastgpt,auth-bypass,wechat
http:
  - raw:
      - |
        POST /api/support/outLink/wechat/logout HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"shareId":"{{randstr}}"}

    matchers:
      - type: word
        part: body
        words:
          - "linkUnInvalid"