CVE-2026-105761

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/langgenius/dify/commit/62cb5b586504b730731e28e743c038b72950058e
https://github.com/langgenius/dify/pull/38177
https://github.com/langgenius/dify/releases/tag/1.16.0
https://github.com/langgenius/dify/security/advisories/GHSA-ccrj-frp2-c945

Configurations

No configuration.

History

05 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-05 23:17

Updated : 2026-10-06 16:08

NVD link : CVE-2026-105761

Mitre link : CVE-2026-105761

CVE.ORG link : CVE-2026-105761

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-105761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105761", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T14:34:11.355920Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "langgenius", "product": "dify", "versions": [{"status": "affected", "version": "< 1.16.0"}]}]}], "published": "2026-10-05T23:17:03.050", "references": [{"url": "https://github.com/langgenius/dify/commit/62cb5b586504b730731e28e743c038b72950058e", "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/pull/38177", "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/releases/tag/1.16.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-ccrj-frp2-c945", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0."}], "lastModified": "2026-10-06T16:08:43.180", "sourceIdentifier": "security-advisories@github.com"}