The FastGPT API includes an endpoint /api/core/chat/record/getCollectionQuote that authenticates the caller’s chat and collection context, but the lookup of a dataset quote using the parameter initialId is not bound to that authorized context. This flaw is classified as CWE-863 and allows a low-privileged tenant user to retrieve text that belongs to a different tenant. By supplying a foreign dataset data id as initialId while providing valid attacker-owned appId, chatId, chatItemDataId, and collectionId, the response includes the requested quote or full-text content from the victim tenant, resulting in a confidentiality breach that can expose proprietary or sensitive information.

The vulnerability affects the labring FastGPT platform running versions from 4.14.17 up to, but not including, 4.15.0-beta5. Version 4.15.0-beta5 incorporates a patch that ensures the initialId lookup is correctly scoped to the authenticated tenant context, thereby preventing cross-tenant data disclosure. Administrators should verify the specific release they are running and plan for an update if they remain within the affected range.

With a CVSS score of 7.7, the flaw falls into the high-severity category. The EPSS score is reported as less than 1%, indicating that at the time of analysis the exploitation probability is very low, yet the impact on confidentiality remains significant. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to already possess a valid application, chat, and collection context belonging to the victim tenant; the attacker must then supply a foreign initialId. This indicates a remote attack vector over authenticated HTTP API calls with moderate effort.