CVE-2025-43862

{"id": "CVE-2025-43862", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2025-04-25T15:15:39.920", "references": [{"url": "https://github.com/langgenius/dify/pull/5266", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-6pw4-jqhv-3626", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access and changes on the APPSs. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can access Orchestration of the APPs."}, {"lang": "es", "value": "Dify es una plataforma de desarrollo de aplicaciones LLM de c\u00f3digo abierto. Antes de la versi\u00f3n 0.6.12, un usuario normal pod\u00eda acceder y modificar la orquestaci\u00f3n de aplicaciones, aunque la interfaz web de la orquestaci\u00f3n no estuviera disponible para un usuario normal. Esta falla de control de acceso permite a usuarios sin privilegios de administrador acceder y realizar cambios no autorizados en las aplicaciones. Este problema se ha corregido en la versi\u00f3n 0.6.12. Una soluci\u00f3n alternativa a esta vulnerabilidad consiste en actualizar los mecanismos de control de acceso para aplicar permisos de rol de usuario m\u00e1s estrictos e implementar controles de acceso basados en roles (RBAC) para garantizar que solo los usuarios con privilegios de administrador puedan acceder a la orquestaci\u00f3n de las aplicaciones."}], "lastModified": "2025-08-01T22:00:11.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "63A68C09-32F4-4AEE-B016-EFBAD72543EC", "versionEndExcluding": "0.6.12"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}