The vulnerability in infiniflow ragflow 0.24.0 allows an attacker to invoke the run_mindmap endpoint with a caller‑selected object or tenant identifier and reach a data‑access operation that is not bound to any owner, tenant, workspace, or membership. This lack of explicit authorization checks can let an attacker read or modify data that belongs to another tenant or workspace, creating a breach of confidentiality and integrity. The published description does not indicate that arbitrary code execution or denial of service is possible, but the breadth of data that could be accessed is significant if the system hosts multiple tenants or workspaces.

The affected product is infiniflow ragflow version 0.24.0. No additional vendor, product, or version detail is provided in the CVE report; the scope is limited to this specific version. Users running this release should verify whether they are using the vulnerable component and check for a patched version.

The CVSS score of 6.5 indicates a moderate to high severity, while the EPSS score remains below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating that no confirmed exploits have been identified publicly. Nonetheless, an attacker with network access to the run_mindmap endpoint could attempt to supply arbitrary tenant identifiers, potentially bypassing tenant isolation. Because the endpoint likely trusts the caller‑provided identifiers without additional validation, the risk of unauthorized disclosure is high if the interface is exposed to untrusted users.