CVE-2026-34082: Dify Authorization Bypass Vulnerability

CVE-2026-34082 Overview

CVE-2026-34082 is an Improper Access Control vulnerability affecting Dify, an open-source LLM (Large Language Model) application development platform. The vulnerability exists in the conversation deletion API endpoint, where insufficient authorization checks allow any authenticated Dify user to delete chat history belonging to other users. This represents a significant data integrity issue that could impact organizations relying on Dify for their LLM-powered applications.

Critical Impact

Authenticated users can delete arbitrary conversation histories belonging to other users, potentially causing data loss, disrupting audit trails, and impacting business operations that depend on conversation retention.

Affected Products

• Dify versions prior to 1.13.1
• All Dify deployments using the vulnerable console API
• Self-hosted and cloud-based Dify installations running unpatched versions

Discovery Timeline

• 2026-04-20 - CVE-2026-34082 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-34082

Vulnerability Analysis

The vulnerability resides in the Dify console API's conversation management functionality. The affected endpoint DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> fails to properly verify that the requesting user has ownership or appropriate permissions over the target conversation before processing the deletion request.

This is classified as CWE-284 (Improper Access Control), where the application does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In this case, the authorization logic only validates that a user is authenticated to the Dify platform, but does not verify that the authenticated user is the owner of the conversation they are attempting to delete.

The network-based attack vector with low complexity makes this vulnerability particularly concerning for multi-tenant Dify deployments where multiple users share the same platform instance. An attacker with basic authenticated access can enumerate and delete conversations across user boundaries.

Root Cause

The root cause is insufficient authorization validation in the conversation deletion handler. The API endpoint accepts the appId and conversationId as path parameters but only verifies that the requesting user has a valid authentication session. The missing authorization check should have validated that the authenticated user owns the specified conversation or has administrative privileges to manage other users' data.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to the Dify platform. Once authenticated, an attacker can craft DELETE requests targeting arbitrary conversation IDs. Since the conversationId parameter is passed directly in the URL path, an attacker could potentially enumerate valid conversation IDs or obtain them through other means such as log files, shared links, or application-level information disclosure.

The attack flow involves the attacker authenticating to Dify with their own valid credentials, then modifying the appId and conversationId parameters in the DELETE request to reference conversations belonging to other users. The server processes the deletion without verifying ownership, resulting in unauthorized data destruction.

Detection Methods for CVE-2026-34082

Indicators of Compromise

• Unusual patterns of DELETE requests to /console/api/installed-apps/*/conversations/* endpoints
• Single user accounts generating high volumes of conversation deletion requests
• Deletion requests targeting conversations that were created by different user accounts
• API access logs showing DELETE operations from users who did not create the associated conversations
• User reports of missing chat history or conversations

Detection Strategies

• Monitor API access logs for DELETE requests to conversation endpoints and cross-reference with conversation ownership data
• Implement anomaly detection for users deleting conversations at rates significantly higher than normal usage patterns
• Create alerts for any deletion requests where the requesting user ID does not match the conversation owner
• Review audit logs for patterns of sequential conversation ID enumeration attempts

Monitoring Recommendations

• Enable detailed API request logging including user identity, target resource IDs, and timestamps
• Configure alerting thresholds for DELETE operations on conversation resources per user per time window
• Implement real-time monitoring of the /console/api/installed-apps/*/conversations/* endpoint for DELETE methods
• Establish baseline metrics for normal conversation deletion patterns to identify anomalous behavior

How to Mitigate CVE-2026-34082

Immediate Actions Required

• Upgrade Dify to version 1.13.1 or later immediately
• Review API access logs for evidence of exploitation prior to patching
• Audit conversation deletion logs to identify any unauthorized deletions that may have occurred
• Notify affected users if unauthorized deletion of their conversation history is detected

Patch Information

Dify version 1.13.1 addresses this vulnerability by implementing proper authorization checks on the conversation deletion endpoint. The patched version verifies that the authenticated user has ownership or appropriate administrative permissions before processing deletion requests. Organizations should upgrade to version 1.13.1 or later as soon as possible. For detailed release information, see the Dify 1.13.1 Release Notes. Additional security details are available in the GitHub Security Advisory GHSA-fxq3-hh7x-c63p.

Workarounds

• Implement network-level access controls to restrict console API access to trusted networks or IP ranges until the patch can be applied
• Deploy a web application firewall (WAF) rule to rate-limit DELETE requests to conversation endpoints
• Temporarily disable the conversation deletion functionality at the reverse proxy level if business requirements permit
• Consider implementing additional authentication factors for destructive API operations

# Example nginx rate limiting for DELETE operations on conversation endpoints
# Add to your nginx server configuration block

limit_req_zone $binary_remote_addr zone=delete_limit:10m rate=5r/m;

location ~ ^/console/api/installed-apps/.*/conversations/.* {
    if ($request_method = DELETE) {
        limit_req zone=delete_limit burst=2 nodelay;
    }
    proxy_pass http://dify_backend;
}