CVE-2026-51896

MEDIUMCVSS 6.5

Description

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

Timeline

Published:October 1st, 2026 10:17 PM

Last modified:October 5th, 2026 7:17 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-284

References & Reports

Advisories, patches, and third-party reports

https://gist.github.com/Ro1ME/3d0bf02f4a51f90c923d37596cc1ac82
https://github.com/infiniflow/ragflow/issues/15269
https://github.com/infiniflow/ragflow/issues/15269

Source: NIST NVD · Data may lag official sources by up to one minute