Access Control Flaw in Dify Platform by Langgenius
CVE-2025-32796
6.5MEDIUM
What is CVE-2025-32796?
Dify, an open-source LLM app development platform, was found to have an access control issue that allows normal users to enable or disable applications through its API, despite the web UI effectively restricting this capability. This flaw poses a risk as it permits unauthorized alterations to application states, potentially leading to disruptions in functionality. Version 0.6.12 of Dify resolves this issue by strengthening API access control mechanisms and implementing strict role-based access controls (RBAC) to ensure that only users with administrative rights can interact with app status changes.