Loading vulnerability…
CVE-2026-68929 is a missing authentication and authorization vulnerability in FastGPT WeChat (iLink) share-channel endpoints before version 4.15.2. The endpoints rely solely on a public share identifier and do not verify an authenticated user identity or ownership of the associated team. The logout operation clears the stored WeChat token after only checking that the target exists, while the QR-code status operation lacks authorization and can write attacker-controlled bot credentials to the selected share-channel record. Because share identifiers are exposed through shared-chat links and embedded integrations, they are not secret authorization values.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This is a small standalone Python 3 proof-of-concept repository containing README.md documentation and poc.py, with no third-party dependencies. It targets CVE-2026-68929 / GHSA-q4pr-3qpg-9q5v, described as missing authorization in FastGPT WeChat (iLink) outLink management handlers. The central weakness is that public shareIds, exposed through share URLs and embeds, are accepted as sufficient authority for sensitive channel operations. The CLI has four modes: probe sends logout with a generated nonexistent shareId and interprets code 501/linkUnInvalid as evidence that an anonymous request reached the vulnerable existence check; harvest extracts shareId query values from a URL or HTML file; dos sends logout for a supplied shareId to clear app.token and set the channel offline; hijack generates a QR code, saves it as victim-qr.png, and polls QR status until an attacker scanning the QR causes attacker-controlled iLink credentials to be associated with the victim's outLink. The exploit makes requests only to a caller-provided FastGPT server; no hard-coded external IP address or command-and-control endpoint is present. The principal impacts are unauthenticated denial of service and cross-tenant WeChat-channel hijacking, potentially exposing victim application responses through the attacker's bot and consuming victim AI resources.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.