Dify Unauthenticated Information Disclosure (CVE-2025-63387)
Date: 2025-12
Affected: Dify Unauthenticated Information Disclosure (CVE-2025-63387)
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2025-63386
CVE-2025-63387
CVE-2025-63388
CWE: CWE-284
CWE-346
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVSS 7.5. Dify v1.9.1 fails to enforce authentication on /console/api/system-features endpoint, exposing enabled features, security protocols, and other sensitive internal configuration to any unauthenticated user. Provides reconnaissance data for follow-on attacks.


Mitigations:

Architectural layers (MAESTRO):