CVE-2025-63387
1 advisory.
PyPI/dify-client CVE-2025-63387: high 7.5
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials o
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.9.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2025-103
- https://gist.github.com/Cristliu/dfc5f3a31dc6d7fff2754867e5c649a5
- https://gist.github.com/Cristliu/cddc0cbbf354de51106ab63a11be94af
- https://github.com/langgenius/dify/discussions
- https://github.com/langgenius/dify/issues/31368#issuecomment-3783712203
- https://github.com/langgenius/dify/pull/31392
- https://github.com/langgenius/dify/pull/31417
CVE-2025-63387 · published · modified · JSON