CVE-2026-51895

Received Received - Intake

Improper Access Control in Ragflow KB Application

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: MITRE

Description

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-51895

Affected Vendors & Products

Vendor	Product	Version / Range
ragflow	ragflow	to 0.24.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Ragflow 0.24.0 and earlier versions have a flaw in the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows improper access control, meaning an attacker could exploit exposed entry points to perform unauthorized actions across different user sessions or escalate privileges without proper authorization.

Impact Analysis

If you use Ragflow 0.24.0 or earlier, an attacker might gain unauthorized access to sensitive data, modify settings without permission, or perform actions reserved for higher-privilege users. This could lead to data leaks, system misuse, or compromised user accounts.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions risk non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade Ragflow to a version beyond 0.24.0 to address the improper access control flaw in update_metadata_setting. Ensure the application is not exposing sensitive API endpoints that could allow unauthorized operations.

Hi! I’m here to help you understand CVE-2026-51895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70