CVE-2026-51895

{
  "etk_id": "ETK-2026-557",
  "cve_id": "CVE-2026-51895",
  "display_id": "CVE-2026-51895",
  "ghsa_id": "GHSA-86mq-h2wm-8hx9",
  "euvd_id": "EUVD-2026-91115",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper access control in Ragflow metadata updates",
  "summary": "Ragflow 0.24.0 and earlier are affected by improper access control in the metadata update handler. Depending on how the affected endpoint is exposed, an attacker may perform unauthorized actions across sessions or privilege boundaries.",
  "mitigation": "Upgrade to a release newer than 0.24.0 after confirming it contains a fix. Until then, restrict access to the affected metadata update endpoint to trusted users and networks.",
  "vendor": null,
  "product": "Ragflow",
  "affected": [
    {
      "affected_notes": [
        "n/a"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "n/a",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 6.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "epss_score": 0.0018,
  "epss_percentile": 0.0731,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 56.1867806,
  "t0_at": "2026-10-01T00:00:00+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-02T18:56:33.394000+00:00",
      "days": 1.7892753935185186,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T00:00:00+00:00",
      "url": "https://github.com/infiniflow/ragflow/issues/15268"
    },
    "trigger_signal": {
      "at": "2026-10-01T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T00:00:00+00:00",
      "url": "https://github.com/advisories/GHSA-86mq-h2wm-8hx9"
    }
  }
}