CVE-2025-32790: Dify Allows Insecure User Role Access Control for APP DSL Exporting
Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 0.6.13 - Configuration
Update access control for the '/export' feature so only admin-privileged users can export APP DSL (prevent normal users from exporting).
Dify /export endpoint Role-based access control (RBAC) for APP DSL exporting = Allow only administrator users
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32790?
CVE-2025-32790 is considered a high severity vulnerability due to improper permission granting to normal users.
How do I fix CVE-2025-32790?
To fix CVE-2025-32790, upgrade to Dify DIFY AI version 0.6.9 or later where the vulnerability has been addressed.
What does CVE-2025-32790 affect?
CVE-2025-32790 affects Dify DIFY AI versions 0.6.8 and prior.
What type of vulnerability is CVE-2025-32790?
CVE-2025-32790 is a permission escalation vulnerability that allows normal users to export APP DSL.
What should I do if I cannot upgrade to fix CVE-2025-32790?
If upgrading is not feasible, ensure strict access control measures are in place to limit normal user permissions.