CVE-2026-51894: Infiniflow ragflow vulnerability
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs to be able to reach the run_mindmap path and supply an object or tenant identifier. The available data does not state whether authentication is required.
What information could be exposed across tenants or workspaces?
The vulnerable path reaches a data-access operation without a visible owner, tenant, workspace, or membership check. This could allow access to data associated with a caller-selected identifier outside the caller's authorized scope.
How can I determine whether my deployment is affected?
Deployments running infiniflow ragflow 0.24.0 should be treated as affected if run_mindmap is reachable. Review whether requests to that path allow callers to select object or tenant identifiers and whether authorization is enforced before the data-access operation.