Dify up through version 1.14.1 contains an authorization bypass flaw that enables authenticated editor users to modify and activate trace configurations for any application, bypassing tenant ownership checks. By enabling a malicious trace provider, all inbound and outbound messages from the target application are redirected to an attacker‑controlled LLM trace provider, exposing sensitive content. The issue was addressed in version 1.14.2, which restores tenant ownership checks. Dify Cloud additionally permits unauthenticated self‑registration, making it trivial for attackers to create editor accounts and exploit the vulnerability.

The affected software is langgenius:dify, specifically all releases up to and including version 1.14.1. Any installation that allows editor‑level users to operate the trace configuration endpoints is vulnerable. The issue also applies to Dify Cloud deployments, where free, unauthenticated self‑registration can create editor accounts with little effort.

The CVSS score of 9.3 marks this exploit as critical, and the EPSS score is 6%. It is not listed in the CISA KEV catalog. Attackers require only an editor account, obtainable through free self‑registration or existing credentials. By creating a malicious trace provider, the attacker can intercept all inbound and outbound messages in real time, compromising confidentiality and integrity of user communications. Based on the description, the attack vector is inferred to be remote via the public API or web interface; this remote nature is not explicitly documented in the CVE data. The vulnerability can be exercised without local compromise.