CVE-2026-51896

{
  "etk_id": "ETK-2026-558",
  "cve_id": "CVE-2026-51896",
  "display_id": "CVE-2026-51896",
  "ghsa_id": "GHSA-fjwv-9m73-7c4f",
  "euvd_id": "EUVD-2026-91114",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper access control in ragflow resume functionality",
  "summary": "Infiniflow ragflow 0.25.3 has improper access control in its resume functionality. An attacker may perform unauthorized operations across sessions or privilege boundaries when they can reach an affected exposed entry point.",
  "mitigation": "Restrict access to affected ragflow entry points to trusted, authenticated users and isolate them from untrusted networks. No fixed version or vendor-supplied workaround is identified in the available evidence.",
  "vendor": "Infiniflow",
  "product": "Ragflow",
  "affected": [
    {
      "affected_notes": [
        "n/a"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "n/a",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 6.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "epss_score": 0.0018,
  "epss_percentile": 0.0726,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 77.0293159,
  "t0_at": "2026-10-01T00:00:00+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T00:00:00+00:00",
      "url": "https://github.com/advisories/GHSA-fjwv-9m73-7c4f"
    }
  }
}