CVE-2026-34082: Dify has IDOR in deleting someone else's chat conversation
Dify is an open-source LLM app development platform. Prior to 1.13.1, the method DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34082?
CVE-2026-34082 has a high severity due to the risk of unauthorized deletion of chat conversations by authenticated users.
How do I fix CVE-2026-34082?
To fix CVE-2026-34082, upgrade to Dify version 1.13.1 or later, which addresses the inadequate authorization checks.
What is the nature of the vulnerability in CVE-2026-34082?
CVE-2026-34082 is an IDOR vulnerability that allows users to delete other users' chat conversations.
Which versions of Dify are affected by CVE-2026-34082?
Dify versions prior to 1.13.1 are affected by CVE-2026-34082.
Can CVE-2026-34082 be exploited remotely?
Yes, CVE-2026-34082 can be exploited remotely by authenticated users with the ability to access the chat deletion endpoint.