UpHeron
All vulnerabilities

Servers and applications

CVE-2025-32796

Unauthorized APP Enable/Disable via API

Severity
Medium 6.5
Published
18 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-hqcx-598m-pjq4
Sources
NVD, Project advisories (GitHub)

Description

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes. This access control flaw allows non-admin users to make unauthorized changes, which can disrupt the…

Affected software

SoftwareAffected versions
DifyServers and applications · cpe:a:langgenius:dify
  • Every version up to 0.6.8
DifyServers and applications · github:langgenius/dify
  • Every version up to 0.6.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-32796
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-32796
  • GitHub Advisory Database https://github.com/advisories/GHSA-hqcx-598m-pjq4
  • github.com https://github.com/langgenius/dify/security/advisories/GHSA-hqcx-598m-pjq4