CVE-2025-63387

High · 7.5

CVSS

7.5

EPSS

29.9%

Published

Dec 18, 2025

CISA due date

—

The record

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data.

Affected packages

Ecosystem	Package	Introduced	Fixed