An authenticated FastGPT user can craft a saved workflow that points to another user's private HTTP toolset via a specially constructed tool ID. This flaw is a CWE-863 weakness that arises from an improper authorization check during workflow save and execution. The platform's toolset routes normally prevent unauthorized access, but the workflow save repeats the authorization check. When the user triggers the workflow through /api/v2/chat/completions, the reference resolves and the victim-owned HTTP tool is executed, allowing the attacker to run arbitrary requests against the victim's toolset infrastructure. This flaw enables the attacker to bypass access controls and potentially exfiltrate data or invoke privileged operations without the victim's consent.

The vulnerability affects labring:FastGPT version 4.14.17 up to, but not including, 4.15.0-beta5. Versions prior to 4.14.17 or 4.15.0-beta5 and later are not affected.

The CVSS score is 5.9, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability that this weakness will be actively exploited. It is not listed in the CISA KEV catalog. The attack requires a legitimate authenticated account to create or alter a workflow referencing a private toolset; the execution occurs during normal workflow runtime. Because the flaw is limited to authenticated users and does not involve remote network entry, the overall risk is moderate but present for existing installations not yet patched.