PT-2026-33858 · Dify · Dify

CVE-2026-34082 · Published 2026-04-20 · Updated 2026-04-21

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.13.1

Description An open-source LLM app development platform contains an authorization bypass. The endpoint '/console/api/installed-apps//conversations/' lacks sufficient authorization checks, allowing any authenticated user to delete the chat history of other users by manipulating the appId and conversationId variables.

Recommendations Update to version 1.13.1.

Exploit

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

CVE-2026-34082

GHSA-FXQ3-HH7X-C63P

Affected Products

Dify

References · 7

• 🔥 https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34082.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34082 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34082 · Vendor Advisory
• https://github.com/langgenius/dify/releases/tag/1.13.1 · Note
• https://twitter.com/CVEnew/status/2046571887556485480 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046484815872991361 · Twitter Post