CVE-2026-34082
Dify has IDOR in deleting someone else's chat conversation
Résumé
Dify has IDOR in deleting someone else's chat conversation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Dify is an open-source LLM app development platform. Prior to 1.13.1, the method DELETE /console/api/installed-apps//conversations/ has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com