CVE-2025-32790

Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/langgenius/dify/commit/59ad091e69736bc9dc1a3bace62ec0a232346246	Patch
https://github.com/langgenius/dify/pull/5841	Issue Tracking Vendor Advisory
https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp	Exploit Mitigation Vendor Advisory
https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2025-04-18 13:15

Updated : 2025-06-19 00:36

NVD link : CVE-2025-32790

Mitre link : CVE-2025-32790

CVE.ORG link : CVE-2025-32790

JSON object : View

Products Affected

langgenius

dify

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2025-32790", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-04-18T13:15:58.177", "references": [{"url": "https://github.com/langgenius/dify/commit/59ad091e69736bc9dc1a3bace62ec0a232346246", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/pull/5841", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13."}, {"lang": "es", "value": "Dify es una plataforma de desarrollo de aplicaciones LLM de c\u00f3digo abierto. En las versiones 0.6.8 y anteriores, se identific\u00f3 una vulnerabilidad en la IA de DIFY que permit\u00eda a los usuarios normales exportar DSL de la aplicaci\u00f3n de forma incorrecta. La funci\u00f3n en '/export' deber\u00eda permitir \u00fanicamente a los usuarios administradores exportar DSL. Un workaround a esta vulnerabilidad consiste en actualizar los mecanismos de control de acceso para aplicar permisos de rol de usuario m\u00e1s estrictos e implementar controles de acceso basados en roles (RBAC) para garantizar que solo los usuarios con privilegios de administrador puedan exportar el DSL de la aplicaci\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.6.13."}], "lastModified": "2025-06-19T00:36:04.717", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "DBA28F0B-2A55-4349-8728-2F6793E4295E", "versionEndExcluding": "0.6.13"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}