SB2025041883 - Multiple vulnerabilities in Dify
Published: April 18, 2025 Updated: July 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2025-43862)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to modify application orchestration and access sensitive information.
The vulnerability exists due to improper access control in the APP orchestration workflow endpoints when handling requests to /app/{app.id}/workflow and related paths. A remote user can send crafted requests to access and modify APP orchestration to modify application orchestration and access sensitive information.
The issue affects non-admin users who should not be able to access the orchestration interface, and exposed orchestration data may include embedded API keys and DSL workflow files.
2) Improper access control (CVE-ID: CVE-2025-32796)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper access control in the /console/api/apps/{app.id}/site-enable and /console/api/apps/{app.id}/api-enable endpoints when handling authenticated API requests. A remote user can send crafted API requests to enable or disable apps to cause a denial of service.
The issue affects actions that are disabled for normal users in the web UI but still accepted by the API.
3) Improper access control (CVE-ID: CVE-2025-32795)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to modify app details.
The vulnerability exists due to improper access control in the app editing endpoints when handling authenticated requests to update app names, descriptions, and icons. A remote user can send a crafted request to modify app details.
Normal users are able to perform edit actions even though they are restricted from viewing apps.
Remediation
Install update from vendor's website.