CVE-2025-43862

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access and changes on the APPSs. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can access Orchestration of the APPs.

• CWE-284
• CWE-862

• https://github.com/langgenius/dify/pull/5266Issue Tracking, Patch
• https://github.com/langgenius/dify/security/advisories/GHSA-6pw4-jqhv-3626Exploit, Vendor Advisory

Published

Apr 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-43857Net::IMAP implements Internet Message Access Protocol (IMAP)…6.5
• CVE-2025-43858YoutubeDLSharp is a wrapper for the command-line video downl…9.2
• CVE-2025-43859h11 is a Python implementation of HTTP/1.1. Prior to version…9.1
• CVE-2025-4386Medtronic MyCareLink Patient Monitor has an internal serial …6.8
• CVE-2025-43860OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-43861ManageWiki is a MediaWiki extension allowing users to manage…5.4
• CVE-2025-43863vantage6 is an open source framework built to enable, manage…9.8
• CVE-2025-43864React Router is a router for React. Starting in version 7.2.…7.5
• CVE-2025-43865React Router is a router for React. In versions on the 7.0 b…8.2
• CVE-2025-43866vantage6 is an open-source infrastructure for privacy preser…7.5
• CVE-2025-4387The Abandoned Cart Pro for WooCommerce plugin contains an au…8.8
• CVE-2025-43873Successful exploitation of these vulnerabilities could allow…8.7