Infiniflow Ragflow Improper Authentication Vulnerability Allowing Unauthorized Access to User Invite Lists

An improper authentication vulnerability has been identified in Infiniflow Ragflow version 0.12.0. This vulnerability allows users to access and view another user's invite list, potentially leading to unauthorized exposure of personal information such as email addresses and usernames. Such data leakage could be exploited for phishing or spam attacks, causing a loss of trust and possible regulatory complications.

Impact

Exploitation of this vulnerability could result in unauthorized access to personal information on invite lists, including email addresses and usernames, leading to privacy breaches and potential phishing or spam attacks.