PT-2025-52282 · Dify · Dify
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Dify version 1.9.1
Description
Dify version 1.9.1 has an issue with insecure permissions. An attacker who is not authenticated can send HTTP GET requests to the
/console/api/system-features API endpoint without providing any authentication. The endpoint does not properly verify authorization, allowing unauthorized access to sensitive system configuration data. Approximately 85,000 instances have been identified online over the past year.Recommendations
Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the
/console/api/system-features endpoint.Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dify