← Vulnerability feed

Vulnerability record · CVE-2024-12869 · published 20 March 2025

CVE-2024-12869: Infiniflow ragflow missing authentication for critical function vulnerability

Infiniflow · Ragflow

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.

4.3 CVSS 3.1 Medium EPSS 0.54% · top 56.4% CWE-306 · Missing authentication for critical function
4.3CVSS 3.1 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://huntr.com/bounties/768b1a56-1e79-416a-8445-65953568b04a Exploit
https://huntr.com/bounties/768b1a56-1e79-416a-8445-65953568b04a Exploit

Track CVE-2024-12869 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-24770Infiniflow ragflow path traversal vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a …EPSS 1.4%9.8CVE-2025-48187Infiniflow ragflow improper restriction of authentication attempts vulnerabilityRAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to p…EPSS 0.54%9.8CVE-2024-12433Infiniflow ragflow deserialization of untrusted data vulnerabilityA vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey…EPSS 1.7%9.8CVE-2024-12450Infiniflow ragflow server-side request forgery (ssrf) vulnerabilityIn infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter …EPSS 1.3%8.9CVE-2025-69286Infiniflow ragflow vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm i…EPSS 0.80%8.9CVE-2025-27135Infiniflow ragflow sql injection vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL componen…EPSS 0.62%8.8CVE-2024-10131Infiniflow ragflow code injection vulnerabilityThe `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses u…EPSS 1.1%8.7CVE-2026-28797Infiniflow ragflow improper input validation vulnerabilityRAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerab…EPSS 0.56%

Source: NIST National Vulnerability Database (record CVE-2024-12869), CISA KEV, FIRST EPSS (scores of 2026-10-07). This page is refreshed as NVD updates the record.