CVE-2025-63387High· 7.5▾ MidnightPoC availableDify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
30%
Nuclei ×1 (last check)
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the description inaccurately classifies the returned data as sensitive system configuration, stating that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed.
dify = 1.9.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-67732Medium· 6.5Dify is an open-source LLM app development platform
CVE-2025-3467Medium· 5.4An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers
CVE-2026-1609High· 8.1A flaw was found in Keycloak
CVE-2026-105635High· 7.4Plane is an open-source project management tool
CVE-2026-105632High· 8.7Plane is an open-source project management tool
CVE-2026-104974High· 8.1Plane is an open-source project management tool