High · published December 19, 2025
⚡ An unauthenticated GET request is all it takes to access sensitive system features in Dify v1.9.1! 🚨 Think of it like a restaurant that leaves the door to the kitchen wide open, allowing anyone to peek inside without a reservation. While the chef might not be preparing anything secretive, you could still see how the dishes are made, and that’s a bit too revealing! An attacker could exploit this flaw to gather non-sensitive system configuration data without any credentials. While the maintainer argues the information isn’t private, it could still provide insights that aid in further attacks or system exploitation. This means potential risk to your application's integrity and an unintended exhibition of your dashboard setup!
Think of it like a restaurant that leaves the door to the kitchen wide open, allowing anyone to peek inside without a reservation. While the chef might not be preparing anything secretive, you could still see how the dishes are made, and that’s a bit too revealing! This vulnerability allows any unauthorized user to send HTTP GET requests to the /console/api/system-features endpoint due to a lack of proper authorization checks, making it accessible without authentication. Though claimed non-sensitive, the access is still unregulated.
An attacker could exploit this flaw to gather non-sensitive system configuration data without any credentials. While the maintainer argues the information isn’t private, it could still provide insights that aid in further attacks or system exploitation. This means potential risk to your application's integrity and an unintended exhibition of your dashboard setup! Ensure you patch to Dify version 1.9.2, which addresses this issue directly. Additionally, implement thorough authorization checks for the endpoint to prevent unauthorized access. Regularly review your API endpoints for similar vulnerabilities to bolster security. You've got this! Follow these steps, and you'll secure your setup in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| langgenius/dify | all versions | — |