The vulnerability in Infiniflow ragflow 0.24.0 arises from incorrect access control on the trace_mindmap endpoint. The endpoint accepts a caller‑selected object or tenant identifier and performs a data‑access operation without enforcing any owner, tenant, workspace, or membership checks. This flaw allows an external actor to read data belonging to arbitrary tenants, leading to potential data exposure. The flaw does not grant write privileges or modify data, so impacts are limited to confidentiality breaches.

Infiniflow ragflow 0.24.0.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, so the known exploitation probability remains low, but the CVSS score of 9.8 indicates a severe risk if exploited. The flaw permits arbitrary access to sensitive data without authentication or authorized context; if an attacker can reach the publicly reachable trace_mindmap endpoint, the risk to exposed data could be high. No specific exploit conditions beyond reaching the publicly reachable path are documented, so the attack surface is the exposed trace_mindmap URL.