CVE-2026-51892 in RAGFlow
Summary
by MITRE • 10/02/2026
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in InfiniFlow RagFlow version 0.24.0 represents a critical failure in access control mechanisms, specifically affecting the endpoint used for retrieving document metadata and content. This flaw allows unauthorized users to bypass authentication or authorization checks when accessing sensitive information stored within the system's knowledge base. The specific vector of this vulnerability is located at the /v1/document/get/<doc_id> API route, which serves as a primary interface for applications and clients to fetch documents associated with their respective RAG (Retrieval-Augmented Generation) workflows. In a properly secured implementation, such endpoints must strictly validate that the requesting user or service account possesses explicit permissions for the specific document identified by doc_id before returning any data. However, in this vulnerable version, the server fails to enforce these checks adequately, leading to a breakdown in the principle of least privilege and vertical access control boundaries.
From a technical perspective, this issue falls under the category of Broken Access Control, which is consistently ranked as one of the most critical security risks by industry standards such as OWASP Top 10 (CWE-284). The root cause typically involves insufficient server-side validation where the application trusts client-supplied identifiers without cross-referencing them against a secure session context or user permission database. An attacker can exploit this flaw by crafting HTTP requests with arbitrary doc_id values, potentially iterating through sequential IDs or guessing valid identifiers to enumerate and access documents belonging to other users or administrative accounts. This lack of object-level authorization means that the system does not distinguish between resources owned by different tenants or users, treating all document retrieval requests as equally privileged if they reach the backend logic without proper gatekeeping at the API layer.
The operational impact of this vulnerability is severe, particularly in multi-tenant environments where data isolation is paramount for compliance and security. Successful exploitation can lead to a complete compromise of confidentiality, allowing attackers to exfiltrate proprietary information, personal identifiable information (PII), or intellectual property stored within the RAG system's document store. Since RagFlow is often used to process sensitive corporate documents for AI-driven insights, this exposure could result in significant regulatory violations under frameworks such as GDPR, HIPAA, or SOC2. Furthermore, if the retrieved documents contain internal network configurations, credentials, or other high-value targets, the attacker may leverage this information for subsequent lateral movement within an organization's infrastructure. The ability to read arbitrary documents also facilitates reconnaissance, enabling adversaries to map out the structure of stored data and identify further attack vectors based on the content found.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK techniques related to Data from Information Repositories (T1213) and potentially Unsecured Credentials if sensitive data is exposed in plaintext formats within those documents. The exploitation does not require complex payload injection or buffer overflow exploits; rather, it relies on simple HTTP manipulation, making it highly accessible to automated scanning tools and low-skill attackers. This simplicity increases the likelihood of widespread compromise across organizations that have deployed this version without immediate patching or compensating controls.
To mitigate this risk, administrators must immediately upgrade RagFlow to a patched version where access control checks are rigorously enforced on all document retrieval endpoints. Until an update is applied, network-level mitigations should be implemented, such as restricting access to the API gateway via IP whitelisting for trusted internal networks only and ensuring that no public-facing ingress points expose this specific endpoint without additional authentication layers like OAuth2 or JWT validation with strict scope verification. Additionally, implementing robust logging and monitoring solutions can help detect anomalous patterns of document access, such as rapid sequential requests for different doc_ids, which may indicate an ongoing enumeration attack. Regular security audits focusing on API authorization logic are essential to prevent similar flaws in future development cycles, ensuring that every resource request is validated against the requester's identity and permissions before processing.