Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the description inaccurately classifies the returned data as sensitive system configuration, stating that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NLanggenius Dify
APPLanggenius1.9.1
Related vulnerabilities
Domyślne dane uwierzytelniające PostgreSQL w Langgenius Dify
Błędna konfiguracja CORS w Dify — endpoint /console/api/setup
Błędna konfiguracja CORS w Dify — nieograniczony dostęp cross-origin z uwierzytelnieniem
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing executi...
Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access ...