CVE-2025-25282: Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow

First published: Fri Feb 21 2025(Updated: )

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list tenant user accounts, add user account into other tenant). Unauthorized cross-tenant access: list user from other tenant (e.g., via GET /<tenant_id>/user/list), add user account to other tenant (POST /<tenant_id>/user). This issue has not yet been patched. Users are advised to reach out to the project maintainers to coordinate a fix.

Credit: security-advisories@github.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/mitre-cve
• source/MITRE
• collector/nvd-api
• source/NVD
• agent/references
• agent/severity
• agent/description
• agent/first-publish-date
• agent/weakness
• agent/last-modified-date
• agent/title
• agent/author
• agent/source
• agent/type
• agent/event
• agent/guess-ai
• agent/softwarecombine
• agent/tags
• vendor/ragflow