Description (CNA)
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| langgenius / dify | affected < 1.9.0 |
CWE
CWE-204
References
- https://github.com/langgenius/dify/security/advisories/GHSA-9qpf-wcv3-w3qx
- https://github.com/langgenius/dify/issues/24323
ADP enrichment
No English description supplied.
No references supplied.