CVE-2025-32790: Langgenius Dify Auth Bypass Vulnerability

CVE-2025-32790 Overview

CVE-2025-32790 is a broken access control vulnerability in Dify, an open-source large language model (LLM) application development platform. In versions 0.6.8 and prior, the /export endpoint fails to validate that the requesting user holds an administrative role. Non-admin users can invoke the endpoint and export APP DSL definitions that should remain restricted to administrators, owners, or editors. The flaw is categorized under [CWE-284: Improper Access Control]. Langgenius patched the issue in Dify 0.6.13 by introducing an explicit role check before the export operation.

Critical Impact

Authenticated low-privilege users can export sensitive APP DSL configurations, exposing application logic and workflow definitions intended only for administrators.

Affected Products

• Langgenius Dify versions 0.6.8 and prior
• Dify self-hosted deployments running on Node.js
• Dify instances exposing the /export console API endpoint

Discovery Timeline

• 2025-04-18 - CVE-2025-32790 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32790

Vulnerability Analysis

Dify exposes an APP DSL export endpoint under api/controllers/console/app/app.py. The get method on the export route invoked AppService() to serialize the application definition without first verifying the caller's role. Any authenticated user, regardless of workspace role, could call the endpoint and receive the complete DSL payload for an application.

APP DSL files encode prompts, model configurations, workflow nodes, dataset bindings, and tool integrations. Unauthorized disclosure of these artifacts leaks intellectual property embedded in prompt engineering and reveals internal workflow design that may aid further attacks on connected services.

Root Cause

The root cause is a missing authorization check on a privileged action. The export handler relied on authentication alone and did not enforce role-based access control (RBAC). The patch adds an is_editor check against the current user, raising Forbidden when the caller lacks sufficient role membership.

Attack Vector

Exploitation requires network access to the Dify console API and a valid low-privileged user account in the target workspace. An attacker authenticates as a normal member, issues an HTTP GET request to the export route for a target application, and receives the serialized DSL in the response body. No user interaction or additional privileges are required.

     @get_app_model
     def get(self, app_model):
         """Export app"""
+        # The role of the current user in the ta table must be admin, owner, or editor
+        if not current_user.is_editor:
+            raise Forbidden()
+
         app_service = AppService()
 
         return {
# Source: https://github.com/langgenius/dify/commit/59ad091e69736bc9dc1a3bace62ec0a232346246

The patch inserts an explicit role gate before any export logic executes, blocking non-editor accounts at the controller layer.

Detection Methods for CVE-2025-32790

Indicators of Compromise

• HTTP GET requests to the Dify console /export endpoint originating from accounts without admin, owner, or editor roles.
• Unexpected volume of DSL export responses in Dify application logs across multiple apps in a short window.
• Access log entries from unfamiliar session tokens or API keys targeting the export route.

Detection Strategies

• Audit Dify application and reverse-proxy logs for requests to the export endpoint and correlate caller identity against workspace role assignments.
• Compare observed exporter accounts against the list of users assigned admin, owner, or editor roles in the Dify tenant_account_join table.
• Alert on export API calls preceded by workspace enumeration requests from the same session.

Monitoring Recommendations

• Enable verbose access logging on the Dify API gateway and forward logs to a centralized SIEM for retention and query.
• Create a saved search for GET /console/api/apps/*/export grouped by user role to surface anomalies.
• Monitor outbound data transfer sizes from the Dify API container to identify bulk DSL extraction attempts.

How to Mitigate CVE-2025-32790

Immediate Actions Required

• Upgrade Dify to version 0.6.13 or later, which enforces the editor role check on the export endpoint.
• Review workspace membership and remove unnecessary low-privileged accounts that could abuse the pre-patch behavior.
• Rotate any secrets, API keys, or credentials referenced inside exported DSL files if logs indicate unauthorized exports.

Patch Information

The fix is published in Langgenius Dify 0.6.13. The code change is tracked in GitHub Pull Request #5841 and merged via commit 59ad091e. Full advisory details are available in GitHub Security Advisory GHSA-jp6m-v4gw-5vgp.

Workarounds

• Place the Dify console API behind a reverse proxy that restricts the /export path to authenticated administrators by source IP or group membership.
• Implement stricter RBAC at the ingress layer to deny export requests from non-admin session tokens until the patch is applied.
• Temporarily disable export functionality in environments where upgrade is not immediately feasible.

# Example nginx snippet restricting the export endpoint by IP allowlist
location ~ ^/console/api/apps/.+/export$ {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://dify_api_upstream;
}