Dify up through version 1.14.1 contains an authorization bypass flaw that enables authenticated editor users to modify and activate trace configurations for any application, bypassing tenant ownership checks. By enabling a malicious trace provider, all inbound and outbound messages from the target application are redirected to an attacker‑controlled LLM trace provider, exposing sensitive content. The issue was addressed in version 1.14.2, which restores tenant ownership checks. Dify Cloud additionally permits unauthenticated self‑registration, making it trivial for attackers to create editor accounts and exploit the vulnerability.

The affected software is langgenius:dify, specifically all releases up to and including version 1.14.1. Any installation that allows editor‑level users to operate the trace configuration endpoints is vulnerable. The issue also applies to Dify Cloud deployments, where free, unauthenticated self‑registration can create editor accounts with little effort.

The CVSS score of 9.3 marks this exploit as critical, while the EPSS score is <1%. It is not listed in the CISA KEV catalog. Attackers only need to register an account (approved in the free self‑registration model) or use existing editor credentials. By creating a malicious trace provider, the attacker can intercept all payloads in real time, compromising confidentiality and integrity of user communications. The vulnerability can be exercised remotely via the public API or web interface, without local compromise.