CVE-2025-63387

creationtimestamp| type| source ---|---|--- 2025-12-19 08:06:02+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-63387.yaml 2025-12-20 21:03:01+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mah44eqgd32r 2025-12-22...

CVE-2025-63387

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...