CVE-2026-51894 in ragflow
Summary
by MITRE • 10/02/2026
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in InfiniFlow Ragflow version 0.24.0 represents a critical failure in access control mechanisms within the run_mindmap functionality. This flaw allows an authenticated attacker to bypass intended security restrictions by manipulating input parameters related to tenant or workspace identifiers. The core issue lies in how the application processes these caller-selected object references during data-access operations. Specifically, the system fails to enforce proper ownership checks, ensuring that a user can only access resources they are explicitly authorized to view or modify. Instead, the application trusts the client-supplied identifier without validating it against the current session's context or verifying the relationship between the requesting user and the target resource. This lack of server-side validation creates an opportunity for unauthorized data exposure, as the system does not bind the requested operation to a visible owner, tenant, workspace, or membership structure that would normally restrict access based on organizational hierarchy or individual permissions.
From a technical perspective, this vulnerability is classified under CWE-284, which covers Improper Access Control, and more specifically aligns with CWE-639 regarding Authorization Bypass Through User-Controlled Key. The attack vector involves the manipulation of API parameters that dictate which data object should be processed by the mindmap generation routine. Because the backend logic does not cross-reference these keys against an access control list or verify tenant isolation boundaries, any authenticated user can potentially retrieve sensitive information belonging to other tenants or users within the same deployment instance. This is particularly dangerous in multi-tenant SaaS environments where data segregation is paramount for compliance and security. The absence of a visible owner binding means that even if metadata exists indicating ownership, it is ignored during the execution path, rendering identity-based restrictions ineffective against this specific endpoint.
The operational impact of this vulnerability extends beyond simple information disclosure. By exploiting this flaw, an attacker can perform unauthorized data exfiltration, potentially accessing proprietary documents, user-generated content, or configuration details stored within the knowledge base managed by Ragflow. This breach compromises confidentiality and integrity, as attackers might also infer structural relationships between different datasets based on how errors are returned or how successful requests behave. Furthermore, if the mindmap generation process involves executing scripts or interacting with external services based on the retrieved data, there is a secondary risk of server-side request forgery or injection attacks depending on downstream processing logic. The vulnerability undermines trust in the platform's ability to isolate customer data, which could lead to significant regulatory penalties under frameworks like GDPR or HIPAA if protected health information or personal identifiable information is exposed due to this access control failure.
Mitigation strategies must focus on implementing robust server-side authorization checks before any data retrieval occurs. Developers should ensure that every API endpoint validates the requesting user's identity and permissions against a centralized policy engine rather than relying solely on client-supplied identifiers. It is essential to enforce strict tenant isolation by verifying that the authenticated session belongs to the same tenant as the requested resource. Additionally, implementing principle of least privilege ensures that users only have access to the minimum data necessary for their role. Regular security audits and penetration testing should be conducted to identify similar patterns in other endpoints where object references are accepted from user input. Updating to a patched version of Ragflow is critical if available, as vendors typically address such flaws by adding explicit ownership verification steps into the business logic layer before database queries or file system operations are executed.