CVE-2025-32795
📋 TL;DR
This CVE describes an improper access control vulnerability in Dify, an open-source LLM app development platform. Normal users can modify app names, descriptions, and icons despite lacking proper permissions, compromising application integrity. All Dify instances running versions before 0.6.12 are affected.
💻 Affected Systems
- Dify
📦 What is this software?
Dify by Langgenius
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could modify or deface critical applications, inject misleading information, or disrupt business operations by altering app metadata.
Likely Case
Unauthorized users tamper with app details, causing confusion, data integrity issues, or minor operational disruptions.
If Mitigated
With proper RBAC, only authorized admins can modify app details, preventing unauthorized changes.
🎯 Exploit Status
Exploitation requires authenticated user access; no public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.12
Vendor Advisory: https://github.com/langgenius/dify/security/advisories/GHSA-gg5w-m2vw-vmmj
Restart Required: Yes
Instructions:
1. Backup your Dify instance. 2. Update Dify to version 0.6.12 or later using your deployment method (e.g., Docker, Kubernetes, manual). 3. Restart the Dify services. 4. Verify the update by checking the version.
🔧 Temporary Workarounds
Manual RBAC Enforcement
allImplement stricter role-based access controls to restrict app modification permissions to admin users only.
🧯 If You Can't Patch
- Restrict user permissions manually in the Dify configuration to prevent non-admin users from accessing app modification features.
- Monitor and audit app modification logs for unauthorized changes and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check the Dify version; if it is below 0.6.12, the system is vulnerable. Test with a non-admin user account to see if app details can be modified.Check Version:
Check the Dify web interface or deployment logs for the version number, or run 'docker ps' if using Docker to inspect the container version.Verify Fix Applied:
After updating to 0.6.12 or later, verify that non-admin users cannot modify app names, descriptions, or icons.📡 Detection & Monitoring
Log Indicators:
- Log entries showing app modifications by non-admin users
- Unauthorized access attempts to app editing endpoints
Network Indicators:
- HTTP POST requests to app modification endpoints from non-admin user accounts
SIEM Query:
source="dify_logs" AND (event="app_modified" OR endpoint="/api/apps/*") AND user_role!="admin"