CVE-2024-11821

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-11821

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11821.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-11821

Published

2025-03-20T10:08:59.022Z

Modified

2026-07-15T01:49:15.906995524Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Privilege Escalation in langgenius/dify

Details

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-250"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11821.json"
}

References

Affected packages

Git / github.com/langgenius/dify

Affected ranges

Type

GIT

Repo

https://github.com/langgenius/dify

Events

Introduced

1f5cc071f8e3541df5d16b258059b157a7b60b73

Last affected

1f5cc071f8e3541df5d16b258059b157a7b60b73

Database specific

{
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "0.9.1"
        },
        {
            "last_affected": "0.9.1"
        }
    ],
    "cpe": "cpe:2.3:a:langgenius:dify:0.9.1:*:*:*:*:node.js:*:*"
}

Affected versions

0.*

0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11821.json"