Improper Access Control in Ragflow by Infiniflow
CVE-2026-51895

6.5MEDIUM

Key Information:

Vendor

Infiniflow

Status
Ragflow
Vendor
CVE Published:
1 October 2026

What is CVE-2026-51895?

Ragflow versions up to 0.24.0 are susceptible to an improper access control vulnerability in the update_metadata_setting function. This flaw allows attackers to conduct unauthorized operations across user sessions or escalate privileges, thereby potentially compromising sensitive data and system integrity.

References

https://github.com/infiniflow/ragflow/issues/15268
https://gist.github.com/Ro1ME/0d1fbed64fa0d73d159a195a827...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.