Threats tagged 'ghsa-gwx5-24gg-jphv'

ragent versions 1.0.0 through 1.1.0 have a missing authorization vulnerability in the RagTraceController component. This flaw allows any authenticated user to access and view RAG traces belonging to other users. The exposed information includes usernames, user IDs, conversation IDs, questions, and detailed per-node execution data. The vulnerability does not allow modification or denial of service but results in unauthorized information disclosure.