What’s Vulnerable › Vulnerabilities

CVE-2025-32790: Dify Allows Insecure User Role Access Control for APP DSL Exporting

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-18 · updated 2026-06-17
• Weakness: CWE-284

Description

Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.

Affected products

• langgenius dify: before 0.6.13 — fixed in 0.6.13

How to fix

Upgrade to a fixed version: langgenius dify 0.6.13. Check the vendor advisory for mitigations.

References

• https://github.com/langgenius/dify/commit/59ad091e69736bc9dc1a3bace62ec0a232346246
• https://github.com/langgenius/dify/pull/5841
• https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp
• https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp

Get alerted when CVE-2025-32790 or the next vulnerability affects your stack