CVE-2026-105761: Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<appid>/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Dify workspace member can exploit it. The issue does not require user interaction, but the attacker needs a valid server ID for an MCP server associated with another application.
Which deployments are affected?
Dify versions prior to 1.16.0 are affected. The vulnerable endpoint is the authenticated PUT /console/api/apps/<app_id>/server endpoint.
What can an attacker change?
An attacker can modify another application's MCP server status and parameters. This could be used to disable the service or redirect data.
How can this be remediated?
Upgrade Dify to version 1.16.0, which fixes the missing verification that the MCP server belongs to the requested application and tenant.