{"id":"CVE-2026-121585","published":"2026-11-04T00:17:26.967","lastModified":"2026-11-04T00:17:27.137","description":"A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-285","CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ZSH402/RAGFlow-Cross-Tenant-Read","tags":[]},{"url":"https://github.com/infiniflow/ragflow/","tags":[]},{"url":"https://github.com/infiniflow/ragflow/issues/15123","tags":[]},{"url":"https://github.com/infiniflow/ragflow/pull/15124","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121585","tags":[]},{"url":"https://vuldb.com/submit/1020561","tags":[]},{"url":"https://vuldb.com/vuln/430429","tags":[]},{"url":"https://vuldb.com/vuln/430429/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/ZSH402/RAGFlow-Cross-Tenant-Read","tags":[]},{"url":"https://github.com/infiniflow/ragflow/","tags":[]},{"url":"https://github.com/infiniflow/ragflow/issues/15123","tags":[]},{"url":"https://github.com/infiniflow/ragflow/pull/15124","tags":[]}],"hasPoc":true,"ai":null}