CVE-2025-25282: Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list tenant user accounts, add user account into other tenant). Unauthorized cross-tenant access: list user from other tenant (e.g., via GET /<tenantid>/user/list), add user account to other tenant (POST /<tenantid>/user). This issue has not yet been patched. Users are advised to reach out to the project maintainers to coordinate a fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25282?
CVE-2025-25282 is classified as a medium severity vulnerability due to potential unauthorized access risks.
How do I fix CVE-2025-25282?
To fix CVE-2025-25282, implement proper access controls to prevent unauthorized cross-tenant access.
What systems are impacted by CVE-2025-25282?
CVE-2025-25282 specifically affects the RAGFlow open-source engine.
Who can exploit CVE-2025-25282?
An authenticated user can exploit CVE-2025-25282 through Insecure Direct Object Reference techniques.
What are the consequences of exploiting CVE-2025-25282?
Exploiting CVE-2025-25282 can lead to unauthorized access to tenant user accounts and sensitive data.