CVE-2025-32795: Dify Privilege Escalation Vulnerability

CVE-2025-32795 Overview

CVE-2025-32795 is a broken access control vulnerability in Dify, an open-source large language model (LLM) application development platform maintained by langgenius. Versions prior to 0.6.12 improperly grant standard users permissions to edit application names, descriptions, and icons. Non-admin users can modify these application details despite being restricted from viewing the applications themselves. The flaw affects the integrity of the application catalog and violates role separation between admin and non-admin roles. The maintainers released a fix in version 0.6.12.

Critical Impact
Authenticated non-admin users can tamper with application metadata (name, description, icon) they are not authorized to view, undermining the integrity of the Dify workspace [CWE-284].

Affected Products

Langgenius Dify versions prior to 0.6.12
Dify deployments running on Node.js
Self-hosted Dify LLM app development platform installations

Discovery Timeline

2025-04-18 - CVE-2025-32795 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32795

Vulnerability Analysis

The vulnerability resides in Dify's application management authorization layer. The platform exposes endpoints that allow editing of application metadata such as name, description, and icon. Prior to version 0.6.12, these endpoints failed to enforce role-based restrictions on write operations. As a result, users lacking view permissions on an application could still submit modification requests and have them accepted. The mismatch between read authorization and write authorization is the core defect classified under [CWE-284] Improper Access Control.

Root Cause

The root cause is missing authorization checks on the application update handlers. Dify's permission model restricts application visibility to admin roles, but the update path did not re-validate the caller's role before applying the mutation. This is a classic case of enforcing access control on read operations while leaving write paths unguarded. The fix in pull request langgenius/dify#5266 adds role-based checks that align write permissions with the existing visibility model.

Attack Vector

An attacker requires authenticated access to the Dify workspace as a standard, non-admin user. From that position, the attacker issues authenticated API requests to the application update endpoints and supplies arbitrary values for the name, description, or icon fields. The request is accepted despite the user lacking view permissions on the target application. Exploitation is network-reachable and requires no user interaction. The vulnerability does not directly expose confidential data or crash the service, but it enables integrity attacks such as branding tampering, phishing lures embedded in descriptions, or misleading icons for downstream users.

Refer to the GitHub Security Advisory GHSA-gg5w-m2vw-vmmj for the vendor's technical description.

Detection Methods for CVE-2025-32795

Indicators of Compromise

Unexpected changes to Dify application name, description, or icon fields performed by users without admin roles.
Audit log entries showing HTTP PUT or PATCH requests to Dify application update endpoints originating from standard user sessions.
Application metadata containing suspicious URLs, unicode obfuscation, or brand-impersonation text.

Detection Strategies

Correlate authenticated Dify API requests with the caller's role and flag write operations on application resources performed by non-admin accounts.
Baseline legitimate admin activity on application update endpoints and alert on deviations from that baseline.
Review Dify database change history for application records modified by user IDs that lack the admin role assignment.

Monitoring Recommendations

Enable and centralize Dify application logs, including request path, HTTP method, authenticated user ID, and role claims.
Forward Dify web-tier and reverse-proxy logs to a SIEM or data lake for retention and query-based hunting.
Alert on repeated 2xx responses to application update endpoints from user accounts that have never held admin privileges.

How to Mitigate CVE-2025-32795

Immediate Actions Required

Upgrade Dify to version 0.6.12 or later on all self-hosted deployments.
Audit existing Dify applications for unauthorized changes to name, description, and icon fields since deployment.
Review the current user-to-role mapping in Dify and remove admin privileges from accounts that do not require them.

Patch Information

The fix is included in Dify version 0.6.12. The upstream code change is available in pull request langgenius/dify#5266, and the coordinated disclosure is documented in GHSA-gg5w-m2vw-vmmj. Upgrading is the recommended remediation path because the patch enforces role-based checks on the affected application update handlers.

Workarounds

Enforce stricter role-based access control (RBAC) at a reverse proxy or API gateway in front of Dify, restricting application update endpoints to admin sessions.
Restrict network access to the Dify management interface so only trusted administrators can reach application update endpoints.
Temporarily reduce the number of non-admin accounts on the platform until the upgrade to 0.6.12 is completed.

bash

# Example: upgrade a self-hosted Dify deployment to the patched version
git fetch --tags
git checkout 0.6.12
docker compose pull
docker compose up -d