The vulnerability is a NoSQL injection in FastGPT’s password change endpoint. An authenticated attacker can inject MongoDB operators to bypass the old‑password verification and change the password for their own account or any account if they can modify the user identifier. Once the password is changed, the attacker gains full control of the account and can maintain persistence. The flaw is classified as CWE‑943, a NoSQL injection that compromises authentication.

The affected product is FastGPT by labring. Versions prior to 4.14.9.5 contain the vulnerability, which is fixed in version 4.14.9.5.

The CVSS score of 8.8 indicates high severity, with potential loss of confidentiality, integrity, and availability. The EPSS score is unavailable, so the exact likelihood of exploitation is unknown, but the vulnerability has been reported publicly and is known to be exploitable by anyone with authenticated access. It is not listed in the CISA KEV catalog, yet an attacker can target users with low privileges, change credentials, and achieve persistence. Prompt remediation is essential to prevent account takeover and potential further compromise.