CVE-2026-51892

Received Received - Intake

Incorrect Access Control in RAGFlow 0.24.0

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: MITRE

Description

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-51892

Affected Vendors & Products

Vendor	Product	Version / Range
infiniflow	ragflow	0.24.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The vulnerability in infiniflow ragflow 0.24.0 allows unauthorized access to documents via an Incorrect Access Control flaw in the /v1/document/get/<doc_id> endpoint. This means attackers could potentially retrieve sensitive documents by manipulating document IDs without proper authorization checks.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to confidential or sensitive documents stored in the system. This may result in data breaches, loss of intellectual property, or exposure of personal information, depending on the documents stored.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by enabling unauthorized access to personal or protected health information. Organizations may face legal penalties, fines, or reputational damage if such breaches occur due to inadequate access controls.

Mitigation Strategies

Immediately update infiniflow ragflow to the latest version beyond 0.24.0 to address the Incorrect Access Control vulnerability in /v1/document/get/<doc_id>.

Hi! I’m here to help you understand CVE-2026-51892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70