CyberRota Analysis
AI-GeneratedInfiniflow Ragflow version 0.24.0 is susceptible to incorrect access control through the trace_mindmap feature, allowing unauthorized access to data by leveraging a caller-selected object or tenant identifier. This vulnerability could lead to unauthorized data exposure or manipulation, posing a significant risk to data integrity and confidentiality. Organizations using this version should prioritize remediation to safeguard sensitive information and maintain compliance with access control policies.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.