FastGPT, an AI agent building platform, suffers from a Cross‑Site Request Forgery vulnerability. The flaw originates in its web page acquisition nodes and HTTP nodes, which initiate data requests from the server. An attacker could exploit this to forge requests that are executed with the privileges of an authenticated user or system, potentially leading to unauthorized data manipulation or disclosure. The weakness is classified as CWE‑352.

The affected product is FastGPT from labring. All releases before version 4.14.7 are vulnerable, as the fix is applied in the 4.14.7 release. No specific earlier version range was supplied, so administrators should consider any version older than 4.14.7 as impacted.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is under 1 %, so the likelihood of exploitation is currently low. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to trick a legitimate user into sending a forged request, or compromise the internal network that the web page acquisition nodes use, leveraging the lack of proper CSRF protections. As the flaw involves state‑changing operations, success could lead to unauthorized configuration changes or data exfiltration.