The vulnerability in ragflow 0.25.3 is an improper access control flaw in the resume endpoint of api/apps/connector_app.py. It allows an attacker who can reach that endpoint to perform operations across different user sessions or elevate privileges, effectively bypassing session isolation. This flaw does not provide direct code execution but grants the malicious actor permission to manipulate or access data that belongs to other users or higher‑privileged accounts, violating confidentiality and integrity. The weakness is identified as CWE-284.

The affected system is the infiniflow ragflow application, specifically the resume endpoint exposed at api/apps/connector_app.py in version 0.25.3. No other vendor or product is listed, and no additional affected versions are specified in the available data.

The CVSS score is 6.5, while the EPSS score is < 1%, indicating a moderate severity and a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, highlighting no known public exploitation. However, because the flaw permits unauthorized cross‑session activity, it represents a significant privacy and integrity risk. An attacker with network access to the API endpoint could exploit the flaw by sending crafted requests to the resume function, leveraging the improper access checks to manipulate data belonging to other users. No specific exploitation prerequisites beyond API access are mentioned, so the vulnerability is straightforward to exploit for anyone who can reach the targeted service.