CVE-2026-40352

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-943

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-403535.4wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel co CVE-2026-403546.3Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink CVE-2026-403557.5In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system CVE-2026-403567.5In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accep CVE-2026-403578.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-403588.4Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-403597.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-40366.5An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation CVE-2026-403607.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-403618.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-403627.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-403638.4Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.