Threats tagged 'ghsa-86mq-h2wm-8hx9'

Ragflow versions 0.24.0 and earlier have an improper access control vulnerability in the update_metadata_setting function within api/apps/kb_app.py. This flaw allows attackers to perform unauthorized cross-session or privilege-crossing operations depending on the exposed entry. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.