Dify CVE-2026-34082

The attacker must be an authenticated Dify user (PR:L satisfies this requirement); no special administrative privileges are needed. The attacker must know or be able to enumerate a valid conversation ID belonging to another user. The DELETE endpoint must be accessible over the network without additional authentication layers (AV:N/AC:L). No special product configuration or non-default deployment mode is required - the vulnerability exists in default Dify installations. Exploitation is hindered only by the need for valid authentication credentials and knowledge of target conversation IDs, but if conversation IDs are predictable or discoverable, these barriers are minimal.

This vulnerability presents moderate real-world risk despite a CVSS score of 5.3. The CVSS vector shows network accessibility (AV:N), low attack complexity (AC:L), and low authentication requirements (PR:L - any authenticated user qualifies), making exploitation straightforward for any user with valid Dify credentials. The impact is limited to integrity violation (VI:L) with no confidentiality or availability compromise, meaning attackers can delete but not read or modify the underlying conversation data in other ways. EPSS scoring data is not provided, limiting exploitation probability assessment. The exploitation conditions are specific: an attacker must have valid Dify authentication credentials and know or guess a valid conversation ID belonging to another user. Given Dify's role as an LLM development platform used in enterprise and development environments, the real-world severity depends on deployment context - multi-tenant SaaS deployments face higher risk than single-organization self-hosted instances. The vulnerability is likely automated and scalable if conversation IDs are sequential or predictable, but requires valid authentication, which reduces opportunistic exploitation. The patched version 1.13.1 is available, making this a manageable risk for organizations that apply updates promptly.

An authenticated user in a shared Dify instance obtains or guesses another user's conversation ID (e.g., through sequential ID enumeration or information disclosure). They craft a DELETE request to /console/api/installed-apps/<appId>/conversations/<conversationId> with the target conversation ID, which is accepted because the authorization check fails to verify ownership. The target user's conversation history is permanently deleted, causing data loss and disrupting their workflow.