Duty Analyst: Joseph McCarthy

CVE-2026-34082

Published: 2026-04-20 23:16:24 | Last modified: 2026-04-23 15:12:30

MEDIUM CVSS 5.3
No EPSS data

Description

Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue.

CVSS details

Severity
medium
Score
5.3
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

This CVE is not currently listed in the EPSS dataset.

Show JSON
{
    "cve": {
        "id": "CVE-2026-34082",
        "cveTags": [],
        "metrics": {
            "cvssMetricV31": [
                {
                    "type": "Primary",
                    "source": "nvd@nist.gov",
                    "cvssData": {
                        "scope": "UNCHANGED",
                        "version": "3.1",
                        "baseScore": 4.3,
                        "attackVector": "NETWORK",
                        "baseSeverity": "MEDIUM",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                        "integrityImpact": "LOW",
                        "userInteraction": "NONE",
                        "attackComplexity": "LOW",
                        "availabilityImpact": "NONE",
                        "privilegesRequired": "LOW",
                        "confidentialityImpact": "NONE"
                    },
                    "impactScore": 1.4,
                    "exploitabilityScore": 2.8
                }
            ],
            "cvssMetricV40": [
                {
                    "type": "Secondary",
                    "source": "security-advisories@github.com",
                    "cvssData": {
                        "Safety": "NOT_DEFINED",
                        "version": "4.0",
                        "Recovery": "NOT_DEFINED",
                        "baseScore": 5.3,
                        "Automatable": "NOT_DEFINED",
                        "attackVector": "NETWORK",
                        "baseSeverity": "MEDIUM",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                        "exploitMaturity": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "userInteraction": "NONE",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "privilegesRequired": "LOW",
                        "subIntegrityImpact": "NONE",
                        "vulnIntegrityImpact": "LOW",
                        "integrityRequirement": "NOT_DEFINED",
                        "modifiedAttackVector": "NOT_DEFINED",
                        "subAvailabilityImpact": "NONE",
                        "vulnAvailabilityImpact": "NONE",
                        "availabilityRequirement": "NOT_DEFINED",
                        "modifiedUserInteraction": "NOT_DEFINED",
                        "modifiedAttackComplexity": "NOT_DEFINED",
                        "subConfidentialityImpact": "NONE",
                        "vulnConfidentialityImpact": "NONE",
                        "confidentialityRequirement": "NOT_DEFINED",
                        "modifiedAttackRequirements": "NOT_DEFINED",
                        "modifiedPrivilegesRequired": "NOT_DEFINED",
                        "modifiedSubIntegrityImpact": "NOT_DEFINED",
                        "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                        "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                        "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                        "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
                    }
                }
            ]
        },
        "published": "2026-04-20T23:16:24.250",
        "references": [
            {
                "url": "https://github.com/langgenius/dify/releases/tag/1.13.1",
                "tags": [
                    "Release Notes"
                ],
                "source": "security-advisories@github.com"
            },
            {
                "url": "https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p",
                "tags": [
                    "Exploit",
                    "Vendor Advisory"
                ],
                "source": "security-advisories@github.com"
            },
            {
                "url": "https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p",
                "tags": [
                    "Exploit",
                    "Vendor Advisory"
                ],
                "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
            }
        ],
        "vulnStatus": "Analyzed",
        "weaknesses": [
            {
                "type": "Secondary",
                "source": "security-advisories@github.com",
                "description": [
                    {
                        "lang": "en",
                        "value": "CWE-284"
                    },
                    {
                        "lang": "en",
                        "value": "CWE-863"
                    }
                ]
            }
        ],
        "descriptions": [
            {
                "lang": "en",
                "value": "Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue."
            }
        ],
        "lastModified": "2026-04-23T15:12:29.810",
        "configurations": [
            {
                "nodes": [
                    {
                        "negate": false,
                        "cpeMatch": [
                            {
                                "criteria": "cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "7E1DAEF4-9EFA-47F5-A2D3-F14C4643E5D2",
                                "versionEndExcluding": "1.13.1"
                            }
                        ],
                        "operator": "OR"
                    }
                ]
            }
        ],
        "sourceIdentifier": "security-advisories@github.com"
    }
}