CVE-2025-43862: Dify Allows Unauthorized Access and Modification of APP Orchestration
Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access and changes on the APPSs. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can access Orchestration of the APPs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 0.6.12 - Configuration
Update Dify access control to enforce stricter user role permissions and implement RBAC so that only users with admin privileges can access APP orchestration (normal users must be prevented from accessing/modifying APP orchestration endpoints even if the UI is not shown).
Dify (APP orchestration access control) RBAC / role-based access controls = only admin users can access Orchestration of the APPs
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43862?
CVE-2025-43862 is considered a moderate severity vulnerability due to the potential for unauthorized access and modification of app orchestration by non-admin users.
How do I fix CVE-2025-43862?
To fix CVE-2025-43862, update to Dify version 0.6.12 or later, which addresses the access control flaw.
What impact does CVE-2025-43862 have on Dify?
CVE-2025-43862 allows normal users to access and modify APP orchestration, leading to possible unauthorized actions within the application.
Who is affected by CVE-2025-43862?
Users of Dify versions prior to 0.6.12 are affected by CVE-2025-43862, particularly those with normal user access.
Is there a workaround for CVE-2025-43862?
There are no recommended workarounds for CVE-2025-43862 other than upgrading to the patched version.