PT-2026-1341

CVE-2025-67732

Published

2026-01-05

Updated

2026-10-07

Description by

CVSS 4.0

8.4

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.11.0

Description Dify is an open-source LLM app development platform. Before version 1.11.0, the API key was exposed in plaintext to the frontend, allowing non-administrator users to view and reuse it. This could lead to unauthorized access to third-party services and potential consumption of limited quotas. The API key, a string used for authentication, was accessible to unauthorized users.

Recommendations Update to version 1.11.0 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-522: Insufficiently Protected Credentials

Related identifiers

CVE-2025-67732