CVE-2024-12880 Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow

A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user has access to multiple tenants, they can manipulate their tenant access to query and acce...

CVE-2024-12880: Authorization Bypass Through User-Controlled Key

A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user has access to multiple tenants, they can manipulate their tenant access to query and acce...

PT-2025-12154 · Unknown · Infiniflow/Ragflow

Name of the Vulnerable Software and Affected Versions: infiniflow/ragflow version RAGFlow-0.13.0 Description: A vulnerability in infiniflow/ragflow allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user ha...