PatchSiren cyber security CVE debrief
CVE-2026-54601 labring CVE debrief
CVE-2026-54601 is a vulnerability in FastGPT, an open-source AI knowledge base platform. From version 4.14.17 to before 4.15.0-beta4, an authenticated tenant user can call the POST /api/core/dataset/collection/create/reTrainingCollection endpoint in a way that persists a server-owned datasetId value from another tenant. This results in mixed dataset objects, leading to inconsistent ownership anchors for downstream dataset, collection, and training endpoints. Consequently, when mixed object IDs are known, this allows cross-tenant read, update, and delete access.
- Vendor
- labring
- Product
- FastGPT
- CVSS
- MEDIUM 6.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-07
- Original CVE updated
- 2026-07-07
- Advisory published
- 2026-07-07
- Advisory updated
- 2026-07-07
Who should care
Organizations using FastGPT versions between 4.14.17 and 4.15.0-beta4 should be aware of this vulnerability. Specifically, administrators and users of FastGPT instances in multi-tenant environments should assess their exposure and apply necessary patches.
Technical summary
The vulnerability arises from improper handling of datasetId values in the reTrainingCollection creation process. An authenticated user can manipulate the datasetId to reference a dataset from another tenant. This leads to the creation of mixed dataset objects that do not accurately reflect their ownership. As a result, downstream endpoints for dataset, collection, and training operations may make authorization decisions based on inconsistent ownership information, potentially allowing unauthorized access across tenants.
Defensive priority
High
Recommended defensive actions
- Upgrade to FastGPT version 4.15.0-beta4 or later
- Review and restrict access to the POST /api/core/dataset/collection/create/reTrainingCollection endpoint
- Monitor for suspicious activity related to dataset and collection operations
- Implement additional access controls to verify tenant ownership for dataset operations
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Evidence notes
The CVE record was published on 2026-07-07T22:16:53.060Z and has not been modified since then. The NVD entry is currently Unassigned. There is no additional information available about the vulnerability beyond what is provided in the CVE record and NVD entry.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-07T22:16:53.060Z and has not been modified since then.