Summary
RAGFlow's agent completion endpoint may execute a private agent workflow before verifying that the authenticated caller is authorized to access it. An authenticated user who knows another user's private agent UUID could read the workflow's output across user or tenant boundaries, and configured tools may perform side effects.
RAGFlow's agent completion endpoint may execute a private agent workflow before verifying that the authenticated caller is authorized to access it. An authenticated user who knows another user's private agent UUID could read the workflow's output across user or tenant boundaries, and configured tools may perform side effects.
Affected context
The issue affects RAGFlow deployments in the affected release range when requests are handled through the agents chat completions endpoint and target an agent marked as private. The authorization check occurs after the completion processing path has already invoked the requested agent, creating a risk when an authenticated user can obtain or guess another user's agent UUID.
The issue affects RAGFlow deployments in the affected release range when requests are handled through the agents chat completions endpoint and target an agent marked as private. The authorization check occurs after the completion processing path has already invoked the requested agent, creating a risk when an authenticated user can obtain or guess another user's agent UUID.
Exploit preconditions
- Attack surface: The authenticated agents chat completions API
- Required access: A valid authenticated RAGFlow user account
- Target knowledge: The UUID of another user's private agent
- Trigger point: A request that invokes the OpenAI-compatible completion path for the targeted agent
- Why exploitation is possible: Agent execution and output handling occur before the access-control check confirms that the caller may access the agent
- Attack surface: The authenticated agents chat completions API
- Required access: A valid authenticated RAGFlow user account
- Target knowledge: The UUID of another user's private agent
- Trigger point: A request that invokes the OpenAI-compatible completion path for the targeted agent
- Why exploitation is possible: Agent execution and output handling occur before the access-control check confirms that the caller may access the agent
Why this happens
The underlying flaw is an authorization-ordering error. The endpoint invokes the requested agent through the completion path and can return its result before UserCanvasService.accessible() verifies ownership or tenant access. This behavior maps to CWE-862: Missing Authorization, because a protected resource is processed without enforcing the required permission check before use.
The underlying flaw is an authorization-ordering error. The endpoint invokes the requested agent through the completion path and can return its result before UserCanvasService.accessible() verifies ownership or tenant access. This behavior maps to CWE-862: Missing Authorization, because a protected resource is processed without enforcing the required permission check before use.
Potential impact
- An attacker may read output from another user's private agent
- Sensitive prompts, retrieved content, or generated responses could be disclosed
- Cross-user or cross-tenant data boundaries could be bypassed
- Configured agent tools could perform unintended side effects
- The affected tenant or application workflow could be exposed to unauthorized actions
- An attacker may read output from another user's private agent
- Sensitive prompts, retrieved content, or generated responses could be disclosed
- Cross-user or cross-tenant data boundaries could be bypassed
- Configured agent tools could perform unintended side effects
- The affected tenant or application workflow could be exposed to unauthorized actions
General mitigation guidance
Mitigation should prioritize authorization before any agent lookup, execution, tool invocation, or response generation.
Common defensive patterns include:
- Enforcing ownership and tenant authorization before dispatching agent workflows
- Applying deny-by-default access checks to private agents
- Revalidating authorization at the service layer rather than relying only on route logic
- Binding agent identifiers to the authenticated user and tenant context
- Limiting tool permissions and executing tools with least privilege
- Avoiding disclosure of workflow output when authorization fails
- Using consistent authorization middleware and secure-by-default endpoint policies
Mitigation should prioritize authorization before any agent lookup, execution, tool invocation, or response generation.
Common defensive patterns include:
- Enforcing ownership and tenant authorization before dispatching agent workflows
- Applying deny-by-default access checks to private agents
- Revalidating authorization at the service layer rather than relying only on route logic
- Binding agent identifiers to the authenticated user and tenant context
- Limiting tool permissions and executing tools with least privilege
- Avoiding disclosure of workflow output when authorization fails
- Using consistent authorization middleware and secure-by-default endpoint policies
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks ensuring authorization precedes business-logic execution
- Tests that request private resources using identities from different users and tenants
- Review signals involving direct object identifiers, especially UUID-based resource access
- API policy enforcement requiring ownership or tenant checks before downstream service calls
- Runtime monitoring for cross-tenant access attempts and authorization failures following agent execution
- Automated security testing that verifies denied requests do not invoke tools or return generated output
Organizations can look for this class of issue through:
- Static analysis and code review checks ensuring authorization precedes business-logic execution
- Tests that request private resources using identities from different users and tenants
- Review signals involving direct object identifiers, especially UUID-based resource access
- API policy enforcement requiring ownership or tenant checks before downstream service calls
- Runtime monitoring for cross-tenant access attempts and authorization failures following agent execution
- Automated security testing that verifies denied requests do not invoke tools or return generated output
