CVE-2026-51893

Summary

The flaw allows an attacker to bypass access controls by manipulating trace_mindmap, potentially leading to unauthorized data access.

Exploitability

Exploitation is relatively straightforward given an externally reachable path and a caller-selected object or tenant identifier.

Blast radius

If exploited, this could result in significant data breaches affecting multiple users and their associated data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to infiniflow ragflow 0.24.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.