Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p Exploit, Vendor Advisory
- https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · difyNVD modified 2026-10-26 00:10
Affected (CPE criteria) 1
cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*
References 3
- https://github.com/langgenius/dify/releases/tag/1.13.1 Release Notes
- https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p Exploit, Vendor Advisory
- https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p Exploit, Vendor Advisory