PT-2025-17318 · Dify · Dify

Zn9988 · Published 2025-04-18 · Updated 2025-04-30 · CVE-2025-32796

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dify versions prior to 0.6.12

Description A vulnerability was identified in Dify, an open-source LLM app development platform, where normal users can enable or disable apps through the API, despite not being permitted to make such changes. This access control flaw allows non-admin users to make unauthorized changes, disrupting the functionality and availability of the apps.

Recommendations For versions prior to 0.6.12, update to version 0.6.12 to resolve the issue. As a temporary workaround, consider updating the API access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can send enable or disable requests for apps.

Exploit

Fix

LPE

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

CVE-2025-32796

GHSA-HQCX-598M-PJQ4

Affected Products

Dify

References · 10

• 🔥 https://github.com/langgenius/dify/security/advisories/GHSA-hqcx-598m-pjq4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32796.json · Exploit
• https://github.com/langgenius/dify/pull/5266 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-32796 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32796 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1913409478772285774 · Twitter Post
• https://twitter.com/dailycve/status/1917634748245238037 · Twitter Post
• https://twitter.com/CVEnew/status/1913312926854946834 · Twitter Post
• https://t.me/cvetracker/21938 · Telegram Post
• https://t.me/cvedetector/23315 · Telegram Post