CVE-2026-34082: Dify has IDOR in deleting someone else's chat conversation

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-20 · updated 2026-10-26
Weakness: CWE-284

Description

Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue.

Affected products

Dify: before 1.13.1 — fixed in 1.13.1

How to fix

Upgrade to a fixed version: Dify 1.13.1. Check the vendor advisory for mitigations.

References

https://github.com/langgenius/dify/releases/tag/1.13.1
https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p
https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p

Get alerted when CVE-2026-34082 or the next vulnerability affects your stack