Auth bypass in Infiniflow Infiniflow/ragflow
CVE-2024-12869
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.
Vulnerability class: Broken Authentication
EPSS: 0.005 (43.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Infiniflow Infiniflow/ragflow — versions unspecified
- Infiniflow Ragflow — versions 0.12.0
Weakness classification (CWE)
References
- security@huntr.dev (Exploit)
Frequently asked questions
- What is CVE-2024-12869?
- CVE-2024-12869 is a medium-severity vulnerability in Infiniflow Infiniflow/ragflow, classified under Missing Authentication for Critical Function. CVSS score: 4.3/10. Published 2025-03-20.
- How severe is CVE-2024-12869?
- Medium severity. CVSS v3 base score is 4.3 out of 10.