CVE-2025-59422

Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?conversation_id=<CONVERSATION_ID>&limit=10 endpoint allows users in the same workspace to read chat messages of other users. A regular user is able to read the query data and the filename of the admins and probably other users chats, if they know the conversation_id. This impacts the confidentiality of chats. This issue has been patched in version 1.9.0.

• CWE-284

• https://github.com/langgenius/dify/commit/b2d8a7eaf1693841411934e2056042845ab4f354Patch
• https://github.com/langgenius/dify/security/advisories/GHSA-jg5j-c9pq-w894Exploit, Vendor Advisory
• https://github.com/langgenius/dify/security/advisories/GHSA-jg5j-c9pq-w894Exploit, Vendor Advisory

Published

Sep 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59417Lobe Chat is an open-source artificial intelligence chat fra…6.1
• CVE-2025-59418BunnyPad is a note taking software. Prior to version 11.0.27…5.5
• CVE-2025-59419Netty is an asynchronous, event-driven network application f…5.5
• CVE-2025-5942Netskope was notified about a potential gap in its agent (NS…5.7
• CVE-2025-59420Authlib is a Python library which builds OAuth and OpenID Co…7.5
• CVE-2025-59421Press, a Frappe custom app that runs Frappe Cloud, manages i…2.7
• CVE-2025-59424LinkAce is a self-hosted archive to collect website links. P…7.3
• CVE-2025-59425vLLM is an inference and serving engine for large language m…7.5
• CVE-2025-59426Lobe Chat is an open-source artificial intelligence chat fra…4.3
• CVE-2025-59427The Cloudflare Vite plugin enables a full-featured integrati…2.9
• CVE-2025-59428EspoCRM is an open source customer relationship management a…5.4
• CVE-2025-59429FreePBX is an open source GUI for managing Asterisk. In vers…5.4