Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Langgenius |
|
No data.
References
History
Thu, 19 Jun 2025 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Langgenius
Langgenius dify |
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:* | |
| Vendors & Products |
Langgenius
Langgenius dify |
Fri, 18 Apr 2025 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A patched version has not been released. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13. | Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13. |
Fri, 18 Apr 2025 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 18 Apr 2025 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A patched version has not been released. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13. | |
| Title | Dify Allows Insecure User Role Access Control for APP DSL Exporting | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-04-18T12:15:11.487Z
Updated: 2025-04-18T13:48:27.073Z
Reserved: 2025-04-10T12:51:12.281Z
Link: CVE-2025-32790
Vulnrichment
Updated: 2025-04-18T12:43:14.216Z
NVD
Status : Analyzed
Published: 2025-04-18T13:15:58.177
Modified: 2025-06-19T00:36:04.717
Link: CVE-2025-32790
Redhat
No data.