CVE-2024-11821 — Privilege Escalation in langgenius/dify
A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by…
Published: 2025-03-20 · CVSS: 4.3 · CVSS 3.0
A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7