Skip to content

Unauthorized APP Enable/Disable via API

Moderate
laipz8200 published GHSA-hqcx-598m-pjq4 Apr 18, 2025

Package

npm https://github.com/langgenius/dify (npm)

Affected versions

<= v0.6.8

Patched versions

None

Description

Summary

A vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes. This access control flaw allows non-admin users to make unauthorized changes, which can disrupt the functionality and availability of the APPS.

Affected Endpoints

  • /console/api/apps/{app.id}/site-enable
  • /console/api/apps/{app.id}/api-enable

Authentication

Yes (normal user)

PoC

  1. The web UI button for this action is disabled for normal user on APP web and API
    image

  2. The following APIs are able to unauthorized toggle the setting of APP web and API

image

image

  1. Normal user unauthorized disable the APP web and API successfully

image

Recommendation

To mitigate this issue, update the API access control mechanisms to ensure that only users with admin privileges can send requests to enable or disable apps. Implement and review role-based access controls (RBAC) for API endpoints to align with the intended permissions set in the web UI.

Impact

This vulnerability allows normal users to enable or disable apps without proper authorization, potentially causing disruption and instability within the APPs. Unauthorized changes to APPs states can lead to service downtime, data loss, and other operational issues. Properly implemented access controls are essential to maintaining the application's security and availability.

Finder Credits:
Aden Yap Chuen Zhen, BAE Systems Digital Intelligence (Malaysia) (Github ID: zn9988)
Ali Radzali, BAE Systems Digital Intelligence (Malaysia) (Github ID: H0j3n)

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE ID

CVE-2025-32796

Weaknesses

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Learn more on MITRE.

Credits