FastGPT’s S3 presign and read handlers do not verify that the S3 key supplied in an HTTP request belongs to the caller’s team. Because the bucket stores tenant identifiers only as part of the key path, an attacker can supply another team’s key and obtain its file contents through the chat‑file presign or dataset preview endpoints. (CWE‑639) leads to cross‑team file disclosure and compromises confidentiality. Based on the description, it is inferred that the attack requires only the ability to send an HTTP request to the affected endpoints with a maliciously chosen key; no additional privileges are needed.

The vulnerable component is FastGPT, an open‑source AI knowledge base platform developed by labring. All releases earlier than v4.15.0‑beta5 are affected; the flaw exists in the chat‑file presign endpoint and the dataset preview endpoint of those versions.

The vulnerability has a CVSS score of 8.6, indicating high severity. The EPSS score is < 1%, meaning a low but nonzero likelihood FastGPT is not listed in CISA’s KEV catalog. Because the bucket is shared globally and the key is a global identifier, an attacker who can send an HTTP request can potentially read files belonging to any team, leading to widespread data leakage. The exploitation path requires only the ability to craft a request with a target key.