CVE-2025-32795: Dify Allows Insecure User Role Access Control for APP Editing
Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite being restricted from viewing apps, which poses a security risk to the integrity of the application. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can modify app details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 0.6.12 - Configuration
Update Dify’s access control mechanisms to enforce stricter user role permissions and implement RBAC so that only users with admin privileges can modify APP names, descriptions, and icons.
Dify access control / app editing permissions role-based access control (RBAC) for app detail editing = Only admin-privileged users can modify APP names, descriptions, and icons
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32795?
CVE-2025-32795 is classified as a medium severity vulnerability due to improper access control affecting user permissions.
How do I fix CVE-2025-32795?
To fix CVE-2025-32795, upgrade Dify to version 0.6.12 or later, which addresses the access control flaw.
Who is affected by CVE-2025-32795?
CVE-2025-32795 affects users of Dify versions prior to 0.6.12 where non-admin users can modify app details.
What type of vulnerability is CVE-2025-32795?
CVE-2025-32795 is an access control vulnerability that allows unauthorized modification of application properties.
What could happen if CVE-2025-32795 is exploited?
If exploited, CVE-2025-32795 could allow non-admin users to change critical app names, descriptions, and icons, leading to potential misinformation or branding issues.