CVE-2025-32790 - CVE House

Back to Database

Status published Medium CVE-2025-32790

Dify Allows Insecure User Role Access Control for APP DSL Exporting

6.3 CVSS

Vulnerability Description

Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32790

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from langgenius

View All →

Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint

Dify Has Broken Access Control on Log Message Endpoint Allows Reading of Chats of Others

Dify MCP OAuth Flow Vulnerable to XSS

Dify has XSS vulnerability

Dify Allows Unauthorized Access and Modification of APP Orchestration

Affected Vendor

langgenius

View all reports →

Affected Software

dify

Vulnerable Versions:

< 0.6.13

Timeline

Official Publish: April 18th, 2025

Last Modified: April 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation