Critical · published December 18, 2025
🔥 A misconfigured CORS policy in Dify v1.9.1 lets any external site make authenticated requests, putting your data at serious risk! 🚨 Think of this as a restaurant that lets anyone use your table reservation to order food, no matter where they come from — if someone sneaky stumbles in, they can serve themselves directly from your plate! An attacker could exploit this vulnerability to send unauthorized requests and access sensitive information as if they were a trusted user. This means they could manipulate data, siphon off private details, and wreak havoc without breaking a sweat. Absolutely devastating!
Think of this as a restaurant that lets anyone use your table reservation to order food, no matter where they come from — if someone sneaky stumbles in, they can serve themselves directly from your plate! The CORS misconfiguration on the /console/api/system-features endpoint allows arbitrary Origin headers and has Access-Control-Allow-Credentials: true, enabling cross-origin requests from any domain with authenticated privileges.
An attacker could exploit this vulnerability to send unauthorized requests and access sensitive information as if they were a trusted user. This means they could manipulate data, siphon off private details, and wreak havoc without breaking a sweat. Absolutely devastating! Immediately patch to a fixed version of Dify, which addresses this CORS misconfiguration. Review your CORS policies to ensure they are restrictive and consider implementing an allowlist for trusted domains to prevent unauthorized access. 🛡️ You've got this! Follow these steps to secure your application, and you'll be a security hero in no time! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| langgenius/dify | all versions | — |