Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-11821Privilege Escalation in langgenius/dify

Medium 4.3

In plain English

A medium-severity security flaw in langgenius/dify from langgenius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.0)4.3Medium

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations.

Affected products (as reported)

Vendor	Product	Versions
langgenius	langgenius/dify	unspecified – through latest

Weakness: CWE-250 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://huntr.com/bounties/76d5986d-3882-4ea7-81cb-f00400e5c6b6