Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor authorization checking and allows any Dify-authenticated user to delete someone else's chat history. Version 1.13.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34082 Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` has poor … https://www.cve.org/CVERecord?id=CVE-2026-34082
Post summary
The post announces CVE‑2026‑34082 against Dify, noting that a DELETE endpoint prior to version 1.13.1 has a flaw, but provides no technical, exploit, or mitigation details.
CVE-2026-34082 Authorization Bypass in Dify LLM Platform Versions Prior to 1.13.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34082
Post summary
CVE-2026-34082 is an authorization bypass vulnerability affecting Dify LLM Platform versions prior to 1.13.1, as disclosed in the provided summary.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dify | dify | - | - | - |