Vulnerability · Published Apr 25, 2025 · Assigned by GitHub_M

CVE-2025-43862Dify Allows Unauthorized Access and Modification of APP Orchestration

High 7.6

In plain English

A high-severity improper access control in dify from langgenius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access and changes on the APPSs. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can access Orchestration of the APPs.

Affected products (as reported)

Vendor	Product	Versions
langgenius	dify	< 0.6.12

Weakness: CWE-284, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

https://github.com/langgenius/dify/security/advisories/GHSA-6pw4-jqhv-3626 x_refsource_CONFIRM
https://github.com/langgenius/dify/pull/5266 x_refsource_MISC