PT-2025-17928 · Dify · Dify

H0J3N + 1 · Published 2025-04-25 · Updated 2025-08-01 · CVE-2025-43862

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dify versions prior to 0.6.12

Description The issue concerns an access control flaw in Dify, an open-source LLM app development platform. This flaw allows non-admin users to make unauthorized access and changes to APPs, despite the web UI of APP orchestration not being presented to normal users.

Recommendations For versions prior to 0.6.12, update to version 0.6.12 to resolve the issue. As a temporary workaround, consider updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can access Orchestration of the APPs.

Exploit

Fix

LPE

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2025-43862

GHSA-6PW4-JQHV-3626

Affected Products

Dify

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43862.json · Exploit
• https://github.com/langgenius/dify/security/advisories/GHSA-6pw4-jqhv-3626 · Vendor Advisory
• https://github.com/langgenius/dify/pull/5266 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-43862 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43862 · Vendor Advisory
• https://twitter.com/CVEnew/status/1915791438392250379 · Twitter Post
• https://t.me/cveNotify/130628 · Telegram Post
• https://t.me/cvedetector/23768 · Telegram Post
• https://t.me/cvetracker/22383 · Telegram Post
• https://t.me/latest_high_impact_cve/2198 · Telegram Post