InfiniFlow RAGFlow 0.13.0

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:infiniflow:ragflow:0.13.0:*:*:*:*:*:*:*

part: a version: 0.13.0 update: *

VendorInfiniflow (1e31eee0-ac8a-568f-ab1d-1dc475e729b7)
ProductRagflow (b792f05b-3d7c-5064-aae3-7291085d97eb)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/infiniflow/ragflow purl2cpe 2026-06-01 10:11:36.457708

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-53450 vulnerable 2026-06-08 06:54:15.024930 Details available
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.
Published: 2024-12-09T00:00:00.000Z
Updated: 2024-12-11T15:54:34.771Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-12880 vulnerable 2026-06-08 06:25:36.273312 Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow
HIGH (8.1)
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user has access to multiple tenants, they can manipulate their tenant access to query and access API tokens of other tenants. This vulnerability affects the following endpoints: /v1/system/token_list, /v1/system/new_token, /v1/api/token_list, /v1/api/new_token, and /v1/api/rm. An attacker can exploit this to access other tenants' API tokens, perform actions on behalf of other tenants, and access their data.
Published: 2025-03-20T10:09:37.911Z
Updated: 2025-10-15T12:49:33.719Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.