{"cve":"CVE-2026-40352","nvd":{"published":"2026-04-17T22:16:32.940","modified":"2026-10-26T21:10:00.170","status":"Analyzed","description":"FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the \"old password\" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-943"],"references":["https://github.com/labring/FastGPT/commit/bd966d479fbe414d02679cf79f9eaaab3d100a2d","https://github.com/labring/FastGPT/releases/tag/v4.14.9.5","https://github.com/labring/FastGPT/security/advisories/GHSA-422w-vrfj-72g6"],"products":["fastgpt:fastgpt"],"source":"nvd","synced_at":"2026-10-26T21:38:48.864438205+00:00"},"epss":{"cve":"CVE-2026-40352","score":0.0038,"percentile":0.31794,"date":"2026-10-26"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}