Access Control Vulnerability in Infiniflow Ragflow Product
CVE-2026-51892

6.5MEDIUM

Key Information:

Vendor

Infiniflow

Status
Ragflow
Vendor
CVE Published:
1 October 2026

What is CVE-2026-51892?

The Infiniflow Ragflow product version 0.24.0 is susceptible to an improper access control vulnerability that allows unauthorized users to access specific documents through a direct API call. This vulnerability is present in the endpoint '/v1/document/get/<doc_id>', which does not adequately verify the user's permissions to retrieve documents. As a result, sensitive information may be exposed to unauthorized individuals, leading to potential data breaches and information leaks.

References

https://github.com/infiniflow/ragflow/issues/15267
https://github.com/infiniflow/ragflow/issues/14618
https://gist.github.com/Ro1ME/00684720b33e37b2dd39856d6c2...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.