EUVD-2026-91116
GHSA-w4g6-3g8p-8mjr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach run_mindmap endpoint over network
-
ExploitSupply victim tenant/object identifier
-
ExecutionServer skips ownership/tenant check
-
ImpactAccess cross-tenant data (C:L/I:L)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the run_mindmap code path and supplying a caller-selected object or tenant identifier that the attacker does not legitimately own; the vulnerable data-access operation proceeds because it lacks any owner, tenant, workspace, or membership check. The realistic precondition is the ability to send requests to this specific RAGFlow endpoint - most impactful in multi-tenant/shared deployments where cross-tenant isolation is expected. LIMITING FACTORS: the NVD vector claims no authentication (PR:N) and no user interaction, but the 'caller-selected tenant identifier' phrasing strongly suggests the caller must already be a tenant/session holder able to reach the endpoint, so a single-tenant or network-isolated instance has materially lower real-world exposure. Impact is bounded to low confidentiality and low integrity (no availability impact). Attacker must also know or enumerate valid object/tenant identifier formats. |
| Impact | This is a moderate-priority access-control flaw (CVE-2026-51894, CWE-284) rather than a critical emergency. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates a network-reachable, low-complexity issue requiring no privileges or user interaction, with low confidentiality and integrity impact and no availability impact - consistent with an IDOR/broken-object-level-authorization bug where a caller-supplied object or tenant identifier reaches a data operation lacking an ownership/tenant binding. Supporting signals are mixed: a public proof-of-concept exists (the referenced GitHub gist), but EPSS is very low at 0.14% (3rd percentile) and the CVE is NOT listed in CISA KEV, so there is no evidence of active or widespread exploitation. CONFLICT TO VERIFY: the CVSS vector asserts PR:N (unauthenticated), yet the description's language about a 'caller-selected object or tenant identifier' in a multi-tenant RAG application typically implies an authenticated tenant escalating across tenant boundaries - the true privilege requirement (PR:N vs PR:L) should be confirmed against the vendor/PoC before treating this as fully pre-authentication. No SSVC decision data was provided. Net: patch when practical, especially in multi-tenant deployments, but POC availability without KEV/EPSS support suggests opportunistic or targeted rather than mass exploitation. |
| Exploit ScenarioDerived | An attacker interacting with a RAGFlow 0.24.0 instance invokes the run_mindmap path while supplying an object or tenant identifier they do not own; because the endpoint performs the data-access operation without validating owner/tenant/workspace membership, it returns or acts on another tenant's data. A public proof-of-concept is referenced (GitHub gist), lowering the skill barrier. Low attack complexity means the request can be crafted directly once the identifier format is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Incorrect access control in infiniflow RAGFlow 0.24.0 allows a caller reaching the run_mindmap code path to supply an object or tenant identifier they do not own and have the resulting data-access operation proceed, because that operation is not bound to any owner, tenant, workspace, or membership check. The result is cross-tenant information disclosure and limited data manipulation in multi-tenant or shared RAGFlow deployments where isolation between tenants is expected; NVD rates it 6.5 with an unauthenticated vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), while our assessment treats it as requiring at least a valid session/tenant context (PR:L), which materially lowers exposure for single-tenant or network-isolated instances. EPSS is 0.14% (3rd percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate-priority access-control defect rather than an emergency.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must currently rely on compensating controls rather than an upgrade to a specific fixed version. The most direct control is to stop exposing the run_mindmap functionality to untrusted callers - either disable or remove that endpoint/feature in the deployment, or block it at the reverse proxy or API gateway, accepting the trade-off that legitimate mind-map generation stops working for all users. Enforce authentication and per-tenant authorization in front of the RAGFlow API (for example, require an authenticated session and validate that the requested object/tenant identifier belongs to the calling principal at the gateway), noting that gateway-level checks are only effective if every path to the backend is covered and identifiers cannot be smuggled through unmediated routes. Restrict network reachability of the RAGFlow service to trusted networks or VPN-only access, and, where cross-tenant isolation is not required, run separate single-tenant instances or isolate tenants by network/credential boundary - this reduces blast radius but increases operational overhead. Add monitoring and alerting for access to run_mindmap with identifiers that do not match the caller's own tenant, and review logs for anomalous cross-tenant object reads. Re-check the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-51894) and the upstream infiniflow/RAGFlow project for a forthcoming fix and apply it as soon as a patched version is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-284 (Improper Access Control) in RAGFlow, an open-source retrieval-augmented-generation engine that exposes document, knowledge-base, and tenant-scoped APIs. The vulnerable entry point is the run_mindmap functionality, which generates mind-map output from underlying documents or datasets; the code path accepts a caller-selected object or tenant identifier and then performs a data-access operation on that identifier without verifying that the requester owns it or belongs to the corresponding owner, tenant, workspace, or membership. Missing authorization binding at the object-resolution step - rather than a cryptographic or input-validation failure - is the root cause, which is why the assessed impact is limited to low confidentiality and low integrity with no availability effect. The supplied CPE string is a placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and the EUVD affected-version field is 'n/a', so the 0.24.0 release named in the description and by the reporter is the only version range presently attributable; consumers should verify their deployed build against upstream changelogs rather than rely on CPE matching.
Know when Ragflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable, low-complexity IDOR; assessed PR:L (not PR:N) because reaching the run_mindmap path and selecting a tenant identifier realistically implies an authenticated caller; low C/I, no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. Rated critical severity (CVSS 9
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary fil
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Rated high severity (CVSS 8.9), this vulnerabilit
RAGFlow versions prior to 0.22.0 generate API keys and beta assistant/agent share tokens with a predictable scheme, lett
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulne
Remote code execution in RAGFlow versions prior to 0.23.0 allows a low-privileged authenticated user (a normal login acc
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. Rated high s
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. Rated high severity (CVS
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data query
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operatin
Exploit-DB