CVE-2026-51893

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-05

Assigner: MITRE

Description

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51893

EUVD

EUVD-2026-91117

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

The vulnerability in infiniflow ragflow 0.24.0 allows unauthorized access to data through a path called trace_mindmap. This path lets an external caller specify an object or tenant ID and access data without proper ownership or membership checks, meaning the system does not verify if the caller should have access to that data.

Impact Analysis

This vulnerability could allow attackers to access sensitive data they are not authorized to see. If exploited, it may lead to data breaches, unauthorized modifications, or leaks of confidential information stored in the system.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using this software may face legal penalties, loss of trust, and increased regulatory scrutiny due to non-compliance with data protection standards.

Mitigation Strategies

Immediately restrict access to the trace_mindmap path in infiniflow ragflow 0.24.0. Ensure all data-access operations enforce tenant, workspace, or membership binding checks. Update to a patched version if available.

Hi! I’m here to help you understand CVE-2026-51893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70