CVE-2025-32795

Katalog CVE

CVSS 6.5 · Medium EPSS 0,30%

Kerentanan Improper Access Control pada langgenius dify. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite being restricted from viewing apps, which poses a security risk to the integrity of the application. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can modify app details.

Rincian

Terbit di NVD

18 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langgenius/dify/pull/5266 issue tracking · advisory vendor
• https://github.com/langgenius/dify/security/advisories/GHSA-gg5w-m2vw-vmmj exploit · mitigasi · advisory vendor