CVE-2025-32790: falha de média gravidade em langgenius dify
Dify Allows Insecure User Role Access Control for APP DSL Exporting
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.3%
probabilidade de exploração
0.3%top 81% das CVEs
exploração observada
nãonenhuma fonte reporta
Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
langgenius · difyCVEs relacionadas — langgenius dify
No mesmo produto, das mais perigosas para as menos.
CVE-2025-58747LOWDify MCP OAuth Flow Vulnerable to XSSEPSS 5.7%CVE-2026-41948CRITICALDify v1.14.1 Path Traversal via Plugin Daemon Internal API AccessEPSS 1.9%CVE-2026-28288MEDIUMDify has a user enumeration issueEPSS 0.7%CVE-2026-41947CRITICALDify < 1.14.2 Authorization Bypass via Trace Configuration EndpointsEPSS 0.6%CVE-2026-41949HIGHDify < 1.14.2 Authorization Bypass via File Preview EndpointEPSS 0.6%CVE-2026-85021MEDIUMlanggenius dify Splash Layout splash.tsx router.replace cross site scriptingEPSS 0.5%