What happened
The OpenAI-compatible agent chat-completions endpoint starts the agent execution and returns the result before the authorization check that confirms the caller is allowed to access that specific agent's canvas. The check is performed too late, so the authorization decision is effectively bypassed.
Why it matters
In a shared RAGFlow deployment this lets one principal exercise another principal's agent (chat history, tools, and any calls the agent makes) despite the access-control layer, enabling cross-tenant information disclosure and unauthorized agent use.
Attack vector
POST /api/v1/agents/chat/completions runs the agent's completion and returns through the openai-compatible branch before UserCanvasService.accessible() verifies the caller may access the requested agent.
Affected systems
RAGFlow 0.25.2 through 0.27.3
Mitigation
Upgrade to RAGFlow 0.27.3+. Fix commit: https://github.com/infiniflow/ragflow/commit/20180790e1a8c55553a2f3e75718f3d65178ae6d