CVE-2026-51895

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-02

Assigner: MITRE

Description

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51895

EUVD

EUVD-2026-91115

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Ragflow 0.24.0 and earlier versions have a flaw in the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows improper access control, meaning an attacker could exploit exposed entry points to perform unauthorized actions across different user sessions or escalate privileges without proper authorization.

Detection Guidance

To detect this vulnerability, inspect the Ragflow application logs for unauthorized access attempts or privilege changes. Check for unusual API calls to update_metadata_setting in api/apps/kb_app.py. Monitor network traffic for unexpected cross-session operations targeting Ragflow endpoints.

Impact Analysis

If you use Ragflow 0.24.0 or earlier, an attacker might gain unauthorized access to sensitive data, modify settings without permission, or perform actions reserved for higher-privilege users. This could lead to data leaks, system misuse, or compromised user accounts.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions risk non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade Ragflow to a version beyond 0.24.0 to address the improper access control flaw in update_metadata_setting. Ensure the application is not exposing sensitive API endpoints that could allow unauthorized operations.

Hi! I’m here to help you understand CVE-2026-51895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70