Improper Access Control in Infiniflow Ragflow by Infiniflow
CVE-2026-51896

6.5MEDIUM

Key Information:

Vendor

Infiniflow

Status
Ragflow
Vendor
CVE Published:
1 October 2026

What is CVE-2026-51896?

The Infiniflow Ragflow 0.25.3 version is susceptible to an improper access control vulnerability that exposes the resume functionality in the api/apps/connector_app.py file. This flaw allows attackers to execute unauthorized cross-session or privilege-crossing actions, potentially compromising user data and application integrity. Organizations using this version of Ragflow should evaluate their exposure to ensure the security of their systems.

References

https://github.com/infiniflow/ragflow/issues/15269
https://gist.github.com/Ro1ME/3d0bf02f4a51f90c923d37596cc...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.