Incorrect Access Control in RAGFlow 0.24.0 via trace_mindmap

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: MITRE

Description

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-51893

Affected Vendors & Products

Vendor	Product	Version / Range
infiniflow	ragflow	0.24.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The vulnerability in infiniflow ragflow 0.24.0 allows unauthorized access to data through a path called trace_mindmap. This path lets an external caller specify an object or tenant ID and access data without proper ownership or membership checks, meaning the system does not verify if the caller should have access to that data.

Impact Analysis

This vulnerability could allow attackers to access sensitive data they are not authorized to see. If exploited, it may lead to data breaches, unauthorized modifications, or leaks of confidential information stored in the system.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using this software may face legal penalties, loss of trust, and increased regulatory scrutiny due to non-compliance with data protection standards.

Hi! I’m here to help you understand CVE-2026-51893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70