RAGFlow CVE-2026-51895

Exploitation requires an authenticated low-privilege account on a reachable RAGFlow instance (version 0.24.0 or earlier) and the ability to invoke the update_metadata_setting operation in api/apps/kb_app.py. The core condition is multi-session or multi-tenant usage where the endpoint is exposed to a user who does not own the targeted knowledge base/metadata entry; the flaw is the missing ownership/authorization check on that entry. Limiting factors: valid credentials are needed (PR:L, not unauthenticated), impact is confined to integrity (metadata tampering) with no confidentiality or availability loss per the CVSS vector, exploitability depends on the specific 'exposed entry' as noted in the description, and the operation is not automatable at scale (SSVC Automatable=no).

This is a moderate-severity, authenticated access-control flaw (CWE-284) in RAGFlow's update_metadata_setting endpoint. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N = 6.5) indicates a network-reachable, low-complexity bug requiring low-privilege authentication (PR:L) with high integrity impact but no confidentiality or availability impact - consistent with the description of unauthorized cross-session or privilege-crossing write operations. Multiple signals point AWAY from mass exploitation: EPSS is very low (0.14%, 3rd percentile), the CVE is NOT in CISA KEV, and SSVC rates Automatable=no with only Partial technical impact. However, a POC does exist (a public gist is referenced and SSVC Exploitation=poc), so the exploitation status is confirmed at the proof-of-concept level, not active exploitation. Net: this is a real but second-tier priority - a genuine authorization bug with available exploit code, but low real-world exploitation probability, requiring an existing authenticated account, and limited to integrity in a niche product. The signals are internally consistent (low EPSS + no KEV + no-automatable + PR:L all align), so there is no major conflict to flag beyond the generally poor NVD metadata (n/a vendor/product/version).

An attacker who holds a valid low-privilege RAGFlow account authenticates and sends a crafted request to the update_metadata_setting endpoint referencing a knowledge base or metadata entry belonging to another tenant/session. Because the endpoint fails to enforce ownership/authorization, the attacker modifies metadata across session or privilege boundaries. A public proof-of-concept exists (referenced gist), lowering the barrier to reproduction.