CVE-2026-41947

Katalog CVE

CVSS 9.1 · Critical EPSS 0,61%

Kerentanan Authorization Bypass Through User-Controlled Key pada dify. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks in the trace configuration endpoints to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

22 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langgenius/dify/pull/35793 issue tracking · mitigasi · patch
• https://huntr.com/bounties/a43076b2-fbc8-4750-9647-89a036b52f52 exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/dify-authorization-bypass-via-trace-configuration-endpoints advisory pihak ketiga
• https://github.com/langgenius/dify/commit/55d05fe52de880cd8497df8cea052351c594fad8
• https://github.com/langgenius/dify/releases/tag/1.14.2
• https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-ten...