CVE-2025-59422: Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others
Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APPID>chat-messages?conversationid=<CONVERSATIONID>&limit=10 endpoint allows users in the same workspace to read chat messages of other users. A regular user is able to read the query data and the filename of the admins and probably other users chats, if they know the conversationid. This impacts the confidentiality of chats. This issue has been patched in version 1.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59422?
The severity of CVE-2025-59422 is classified as medium due to the potential for unauthorized access to chat messages.
How do I fix CVE-2025-59422?
To fix CVE-2025-59422, update Dify to version 1.9.0 or later where the vulnerability is addressed.
What type of vulnerability is CVE-2025-59422?
CVE-2025-59422 is a broken access control vulnerability that allows users to access chat messages from other users in the same workspace.
In which versions of Dify is CVE-2025-59422 present?
CVE-2025-59422 affects Dify versions prior to 1.9.0, specifically impacting version 1.8.1.
Who is affected by CVE-2025-59422?
Users of Dify who have access to the /console/api/apps/<APP_ID>chat-messages endpoint in version 1.8.1 are affected by CVE-2025-59422.