Nixpkgs security tracker
Dismissed
(not in Nixpkgs)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
Dify has IDOR in deleting someone else's chat conversation
Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue.
References
-
https://github.com/langgenius/dify/security/advisories/GHSA-fxq3-hh7x-c63p x_refsource_CONFIRM
-
https://github.com/langgenius/dify/releases/tag/1.13.1 x_refsource_MISC
Affected products
dify
- ==< 1.13.1
Matching in nixpkgs
pkgs.speedify
Use multiple internet connections in parallel
-
nixos-unstable 15.8.2-12611
- nixpkgs-unstable 15.8.2-12611
- nixos-unstable-small 15.8.2-12611
-
nixos-25.11 15.8.2-12611
- nixos-25.11-small 15.8.2-12611
- nixpkgs-25.11-darwin 15.8.2-12611
Package maintainers
-
@vdemeester Vincent Demeester <vincent@sbr.pm>
-
@zahrun Zahrun <zahrun@murena.io>