What’s Vulnerable › Vulnerabilities
CVE-2024-11821: Privilege Escalation in langgenius/dify
- Severity: medium (CVSS 4.3 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-20 · updated 2026-06-17
- Weakness: CWE-250
Description
A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations.
Affected products
- langgenius dify: 0.9.1
References
Get alerted when CVE-2024-11821 or the next vulnerability affects your stack