TI-2025-23832 Aliases CVE-2025-32795

Dify Allows Insecure User Role Access Control for APP Editing

MEDIUM 62CWE-284Published 2025-04-18 · Updated 2025-04-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite being restricted from viewing apps, which poses a security risk to the integrity of the application. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can modify app details.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00301 23rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed dify (langgenius): 0.6.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
langgenius	dify	before 0.6.12	0.6.12	Patch available	CNA

dify Vendorlanggenius Affected before 0.6.12 Fixed in 0.6.12 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:langgenius:dify::::::node.js::*	before 0.6.12	Vulnerable	langgenius

cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:* Versions before 0.6.12 Vulnerable ·langgenius

Remediation

Fix · CNA dify (langgenius) Fixed in 0.6.12

Timeline

2026-10-02 Threatist record created from CVE-2025-32795

References

Exploit 1

https://github.com/langgenius/dify/security/advisories/GHSA-gg5w-m2vw-vmmj

Advisory 1

https://github.com/langgenius/dify/pull/5266

TI-2025-35265 Default credentials in Dify thru 1.5.1. CVSS 3.1CRITICAL 9.8
TI-2025-03045 Unsanitized Input in langgenius/dify CVSS 3.1HIGH 7.2
TI-2025-01548 Admin account takeover through weak Pseudo-Random number generator used in generating… CVSS 3.1HIGH 8.8
TI-2026-30470 Dify Vulnerable to Stored XSS via SVG-file upload CVSS 4.0MEDIUM 6.9
TI-2024-11840 Authentication Bypass in langgenius/dify CVSS 3.0HIGH 8.1
TI-2024-11170 Improper Restriction of Excessive Authentication Attempts in langgenius/dify CVSS 3.1HIGH 8.1

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences