Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-12869Improper Authentication in infiniflow/ragflow

Medium 4.3

In plain English

A medium-severity missing authentication in infiniflow/ragflow from infiniflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.0)4.3Medium

Exploit odds (30 days)0.5%top 53.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.

Affected products (as reported)

Vendor	Product	Versions
infiniflow	infiniflow/ragflow	unspecified – through latest

Weakness: CWE-306 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://huntr.com/bounties/768b1a56-1e79-416a-8445-65953568b04a