RAGFlow CVE-2026-51896

Requires a valid authenticated RAGFlow account at low privilege (CVSS PR:L); the attacker then invokes the resume functionality in api/apps/connector_app.py and targets a session or resource outside their authorization scope. Exploitation is network-reachable and low-complexity (AV:N/AC:L) with no user interaction (UI:N), but the realized impact depends on which connector entry/endpoint is exposed and reachable in the deployment, per the description's 'depending on the exposed entry' qualifier. Specifically limited to RAGFlow 0.25.3; the key limiting factor is the authentication prerequisite - unauthenticated internet-wide exploitation is not supported by the vector.

This is a moderate-severity, low-priority issue in practical terms. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) indicates a network-reachable, low-complexity flaw that nonetheless REQUIRES authentication (PR:L), so it is not a pre-auth mass-exploitation candidate. Exploitation signals are weak and consistent with each other: EPSS is only 0.14% (3rd percentile), the CVE is NOT on the CISA KEV list, and there is no confirmed proof-of-concept flag in the input (a researcher gist is referenced and may contain PoC details, but this is unverified). SSVC-style reasoning puts this at exploitation=none/PoC-unverified, automatable=no (requires a valid account and knowledge of the 'exposed entry'), technical impact=partial (integrity-only). The high-CVSS-but-moderate-real-risk pattern applies: integrity impact is rated High, but the authentication requirement and absence of confirmed exploitation make this a patch-in-normal-cycle item rather than an emergency. Data gap to note: the description says impact depends on 'the exposed entry,' so actual impact is conditional and not fully pinned down - the fixed I:H/C:N rating may understate confidentiality if cross-session access also leaks another user's data.

A low-privileged but authenticated RAGFlow user sends a crafted request to the connector resume endpoint (api/apps/connector_app.py), referencing a session or resource belonging to another user or a higher-privilege context. Because access control is not properly enforced, the server executes the operation across that session/privilege boundary, letting the attacker tamper with or drive operations they should not control. No confirmed public exploit exists, though a referenced researcher gist may contain reproduction details; given AC:L, exploitation is technically simple once a valid account is held.