Dify CVE-2025-67732

Requires an authenticated non-administrator account on the Dify instance (PR:L); it is not anonymously exploitable. The specific trigger is that Dify prior to 1.11.0 serves third-party service API keys in plaintext within frontend responses/configuration views, so any logged-in non-admin who inspects the frontend can read and reuse them. Limiting factors: a valid user account is needed, the instance must run an affected version (<1.11.0), and meaningful impact depends on the leaked keys granting access to consequential or quota-limited third-party services. No user interaction by a victim and no special non-default configuration is required beyond having third-party service credentials configured in Dify.

Signals point to a real but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L means a valid non-administrator account on the Dify instance is required - this is a privilege/trust-boundary flaw, not anonymous exploitation. EPSS is very low at 0.04% (13th percentile), indicating no modeled likelihood of mass exploitation, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. The only exploit signal is the GitHub Security Advisory reference tagged as 'exploit'; treat this as vendor disclosure detail rather than confirmed weaponized exploit code - no independent public PoC is evidenced beyond the advisory itself. The impact profile is confidentiality-dominant (VC:H: plaintext API key leak) with cascading effects on third-party services (SC:H, SI:L, SA:L), consistent with CWE-200. Net: a genuine information-disclosure/trust-boundary defect worth patching, but the authentication requirement and near-zero EPSS place it well below internet-facing unauthenticated RCE-class risk.

A low-privileged non-administrator user logs into a shared Dify instance and opens a configuration page whose frontend response includes a third-party service API key (e.g., an LLM provider or integration credential) in plaintext. The user copies the key and reuses it outside Dify to make unauthorized calls against the third-party service, consuming the organization's limited quota or incurring cost. The GitHub advisory documents the flaw, but exploitation is trivial and requires only an ordinary account plus browser dev-tools inspection.