CVE-2025-32790: fallo de gravedad media en langgenius dify
Dify Allows Insecure User Role Access Control for APP DSL Exporting
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.3epss 0.3%
probabilidad de explotación
0.3%top 81% de las CVE
explotación observada
noninguna fuente lo reporta
Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Productos afectados
langgenius · difyCVEs relacionadas — langgenius dify
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-58747LOWDify MCP OAuth Flow Vulnerable to XSSEPSS 5.7%CVE-2026-41948CRITICALDify v1.14.1 Path Traversal via Plugin Daemon Internal API AccessEPSS 1.9%CVE-2026-28288MEDIUMDify has a user enumeration issueEPSS 0.7%CVE-2026-41947CRITICALDify < 1.14.2 Authorization Bypass via Trace Configuration EndpointsEPSS 0.6%CVE-2026-41949HIGHDify < 1.14.2 Authorization Bypass via File Preview EndpointEPSS 0.6%CVE-2026-85021MEDIUMlanggenius dify Splash Layout splash.tsx router.replace cross site scriptingEPSS 0.5%