CVE-2026-51896: Infiniflow ragflow vulnerability
infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connectorapp.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The available information does not specify authentication requirements or the exact exposed entry point. Exploitation depends on an attacker being able to reach a vulnerable resume-related entry in api/apps/connector_app.py.
What is the potential impact?
An attacker may be able to perform unauthorized operations across sessions or cross privilege boundaries. The specific operations and affected roles are not identified in the available information.
Are default deployments affected?
The available information identifies RAGFlow version 0.25.3 but does not state whether the vulnerable functionality is enabled or exposed in a default deployment.
How can I determine whether my deployment may be affected?
Check whether your deployment uses InfiniFlow RAGFlow 0.25.3 and exposes resume-related connector functionality implemented in api/apps/connector_app.py. The available information does not provide a detection method or indicators of compromise.