Dify up to version 1.14.1 suffers an authorization bypass flaw that lets an authenticated editor set trace configuration for any application, regardless of tenant ownership. Once a trace provider is enabled, all incoming and outgoing messages on the victim application are redirected to the attacker‑controlled LLM trace provider, exposing sensitive content. The vulnerability is classified as CWE‑639, a user‑controlled data flow issue that enables unauthorized data exposure.

The affected software is langgenius:dify, specifically all releases up to and including version 1.14.1. Any installation that allows editor‑level users to operate the trace configuration endpoints is vulnerable. The issue also applies to Dify Cloud deployments, where free, unauthenticated self‑registration can create editor accounts with little effort.

The CVSS score of 9.1 marks this exploit as critical, while an EPSS score is currently unavailable. It is not listed in the CISA KEV catalog. Attackers only need to register an account (approved in the free self‑registration model) or use existing editor credentials. By creating a malicious trace provider, the attacker can intercept all payloads in real time, compromising confidentiality and integrity of user communications. The vulnerability can be exercised remotely via the public API or web interface, without local compromise.