CVE-2025-63387

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the description inaccurately classifies the returned data as sensitive system configuration, stating that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed.

• CWE-284

• https://gist.github.com/Cristliu/cddc0cbbf354de51106ab63a11be94afThird Party Advisory
• https://gist.github.com/Cristliu/dfc5f3a31dc6d7fff2754867e5c649a5
• https://github.com/langgenius/dify/discussionsIssue Tracking
• https://github.com/langgenius/dify/issues/31368#issuecomment-3783712203
• https://github.com/langgenius/dify/pull/31392
• https://github.com/langgenius/dify/pull/31417

Published

Dec 18, 2025

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6337A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0…8.8
• CVE-2025-63371Milos Paripovic OneCommander 3.102.0.0 is vulnerable to Dire…7.5
• CVE-2025-63372Articentgroup Zip Rar Extractor Tool 1.345.93.0 is vulnerabl…4.3
• CVE-2025-6338There is an incomplete cleanup vulnerability in Qt Network's…9.2
• CVE-2025-63384A vulnerability was discovered in RISC-V Rocket-Chip v1.6 an…6.5
• CVE-2025-63386A Cross-Origin Resource Sharing (CORS) misconfiguration vuln…9.1
• CVE-2025-63388A Cross-Origin Resource Sharing (CORS) misconfiguration vuln…9.1
• CVE-2025-63389A critical authentication bypass vulnerability exists in Oll…9.8
• CVE-2025-6339A vulnerability was found in ponaravindb Hospital Management…9.8
• CVE-2025-63390An authentication bypass vulnerability exists in AnythingLLM…5.3
• CVE-2025-63391Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2025-63396An issue was discovered in PyTorch v2.5 and v2.7.1. Omission…3.3