CVE-2026-105761

Katalog CVE

CVSS 7.1 · High EPSS 0,25%

Kerentanan Authorization Bypass Through User-Controlled Key. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Deferred

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/langgenius/dify/commit/62cb5b586504b730731e28e743c038b72950058e
• https://github.com/langgenius/dify/pull/38177
• https://github.com/langgenius/dify/releases/tag/1.16.0
• https://github.com/langgenius/dify/security/advisories/GHSA-ccrj-frp2-c945