Privilege Escalation in Langgenius Dify Chatbot Framework
CVE-2024-11821
4.3MEDIUM
What is CVE-2024-11821?
A privilege escalation vulnerability in Langgenius Dify version 0.9.1 enables unauthorized users to modify chatbot configurations. This issue occurs due to inadequate enforcement of access controls at the endpoint /console/api/apps/{chatbot-id}/model-config, permitting typical users to override settings intended solely for admin users. Such a flaw can lead to severe changes in chatbot behavior, affecting operational integrity and user trust.
Affected Version(s)
langgenius/dify <= unspecified