Skip to content
OpenAdvisories

Product · langgenius

dify

30 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-105761 Public exploit

    Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

    Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied se…

    langgenius dify