CVE-2026-51893 and CVE-2026-51897: RAGFlow 0.24.0 lets any logged-in user open other users' mindmap tasks and evaluation datasets
Two missing ownership checks in RAGFlow 0.24.0. The trace_mindmap handler in api/apps/kb_app.py and the get_dataset handler in api/apps/evaluation_app.py take a caller-supplied task or dataset id and return it without checking that it belongs to the caller's user or tenant.
What it is
CVE-2026-51893: trace_mindmap (api/apps/kb_app.py) accepts a caller-selected task or tenant identifier and reaches the data-access call with no owner, tenant or membership check. In the reporter's reproduction, a second user replays a request with the victim's mindmap task id.
CVE-2026-51897: GET /dataset/<dataset_id> in api/apps/evaluation_app.py only requires login and returns the evaluation dataset without verifying ownership. NVD's description adds that, depending on the exposed entry, it can lead to attacker-controlled code or command execution; the public report only demonstrates the cross-user read.
Both reports name RAGFlow 0.24.0 as affected and do not name a fixed version.
How to check
- Check whether you run RAGFlow 0.24.0, especially with more than one user or tenant.
- Check whether sign-up is open on your instance, since any account is enough.
How to fix
- Move to a current RAGFlow release and confirm in its changelog or code that trace_mindmap and the evaluation get_dataset route check ownership, since the reports name no fixed version.
- Until then, turn off public sign-up and keep the instance limited to users who may see each other's data.