CVE-2025-59422: fallo de gravedad media en langgenius dify
Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6epss 0.2%
probabilidad de explotación
0.2%top 85% de las CVE
explotación observada
noninguna fuente lo reporta
Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?conversation_id=<CONVERSATION_ID>&limit=10 endpoint allows users in the same workspace to read chat messages of other users. A regular user is able to read the query data and the filename of the admins and probably other users chats, if they know the conversation_id. This impacts the confidentiality of chats. This issue has been patched in version 1.9.0.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
langgenius · difyCVEs relacionadas — langgenius dify
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-58747LOWDify MCP OAuth Flow Vulnerable to XSSEPSS 5.7%CVE-2026-41948CRITICALDify v1.14.1 Path Traversal via Plugin Daemon Internal API AccessEPSS 1.9%CVE-2026-28288MEDIUMDify has a user enumeration issueEPSS 0.7%CVE-2026-41947CRITICALDify < 1.14.2 Authorization Bypass via Trace Configuration EndpointsEPSS 0.6%CVE-2026-41949HIGHDify < 1.14.2 Authorization Bypass via File Preview EndpointEPSS 0.6%CVE-2026-85021MEDIUMlanggenius dify Splash Layout splash.tsx router.replace cross site scriptingEPSS 0.5%