CVE-2025-32796

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes. This access control flaw allows non-admin users to make unauthorized changes, which can disrupt the functionality and availability of the APPS. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the API access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can send enable or disable requests for apps.

• CWE-284
• CWE-863

• https://github.com/langgenius/dify/pull/5266Issue Tracking, Patch
• https://github.com/langgenius/dify/security/advisories/GHSA-hqcx-598m-pjq4Exploit, Vendor Advisory
• https://github.com/langgenius/dify/security/advisories/GHSA-hqcx-598m-pjq4Exploit, Vendor Advisory

Published

Apr 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32790Dify is an open-source LLM app development platform. In vers…4.3
• CVE-2025-32791The Backstage Scaffolder plugin houses types and utilities f…4.3
• CVE-2025-32792SES safely executes third-party JavaScript 'strict' mode pro…8.7
• CVE-2025-32793Cilium is a networking, observability, and security solution…4
• CVE-2025-32794OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-32795Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32797Conda-build contains commands and tools to build conda packa…7
• CVE-2025-32798Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-32799Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-3280The ELEX WooCommerce Advanced Bulk Edit Products, Prices & A…6.5
• CVE-2025-32800Conda-build contains commands and tools to build conda packa…9.8
• CVE-2025-32801Kea configuration and API directives can be used to load a m…7.8