Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-63387

Good to know:

icon

Date: December 18, 2025

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data.

Severity Score

Related Resources (4)

https://gist.github.com/Cristliu/cddc0cbbf354de51106ab63a11be94af
https://github.com/langgenius/dify/discussions
https://nvd.nist.gov/vuln/detail/CVE-2025-63387
https://www.mend.io/vulnerability-database/CVE-2025-63387

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us