CVE-2025-67732

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party services, potentially consuming limited quotas. Version 1.11.0 fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-522

Affected software

Vendor	Product	Versions
langgenius	dify	< 1.11.0

References

https://github.com/langgenius/dify/security/advisories/GHSA-phpv-94hg-fv9gExploit, Third Party Advisory

Timeline

Published: Jan 5, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-677337.1Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands t CVE-2025-677345.4Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed auth CVE-2025-677356.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.hand CVE-2025-677367.2The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions CVE-2025-677373.7AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for i CVE-2025-677388.5squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager CVE-2025-677393.1In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure CVE-2025-67746.3A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp o CVE-2025-677405.3In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata CVE-2025-677415.4In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute CVE-2025-677427.5In JetBrains TeamCity before 2025.11 path traversal was possible via file upload CVE-2025-677436.5Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download s