CVE-2025-43862

Summary

CVE-2025-43862: In the open-source Dify LLM app development platform, prior to version 0.6.12, normal users were able to bypass access controls and modify APP orchestration, granting unauthorized access and change permissions. This vulnerability posed a significant risk, as the web UI for APP orchestration was not accessible to non-admin users. The issue has been resolved in version 0.6.12. To mitigate this risk, administrators should update their access control mechanisms to enforce stricter user role permissions and implement role-based access controls (RBAC), ensuring that only users with admin privileges can access the APP orchestration.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.