CVE-2025-63387

Dify 1.9.1, the open-source LLM application platform from LangGenius, serves its /console/api/system-features endpoint without any authentication, allowing an unauthenticated attacker to read the returned system configuration data with a simple HTTP GET request. The flaw (CWE-284, Insecure Permissions) is triggered by sending the request with no session token or credentials and requires no user interaction; the CVSS 3.1 score of 7.5 (high) assumes high confidentiality impact. However, the maintainer states the endpoint is unauthenticated by design as a bootstrap mechanism required for dashboard initialization and client-side rendering, and that the returned data is non-sensitive, with no PII, credentials, or secrets exposed. Any Dify 1.9.1 deployment is in scope per the advisory, with risk concentrated in self-hosted instances whose console API is reachable from the internet. No public proof-of-concept or confirmed in-the-wild exploitation is known, although EPSS assigns a 30.3% probability of exploitation within 30 days (98th percentile).

What to do: Operators of internet-exposed Dify 1.9.1 instances should verify what GET /console/api/system-features returns and, if the console need not be publicly reachable, restrict access to the /console/api path via reverse-proxy ACLs or firewall rules. Because the maintainer classifies the behavior as by-design, remediation may involve exposure reduction rather than an upgrade, but teams should watch for a patched release or official LangGenius advisory. Given the elevated 30% 30-day EPSS probability, monitor for new PoCs or scanning activity against this endpoint.