Dify version 1.9.1 is vulnerable to unauthorized access via the system-features API, allowing unauthenticated attackers to retrieve system configuration data.

The vulnerability is an insecure permission flaw located in the /console/api/system-features endpoint. The application fails to perform authorization checks, enabling an unauthenticated attacker to retrieve configuration data via HTTP GET requests.

The exploitation of this vulnerability allows unauthorized access to system configuration data, which could facilitate reconnaissance for more complex attacks. While the vendor disputes the sensitivity of this data, a CVSS score of 7.5 indicates a high risk level that necessitates immediate attention to prevent unauthorized information disclosure.

Immediate Action: Update Dify to the latest version as specified in the vendor security advisory to implement proper authorization checks.

Proactive Monitoring: Review access logs for the /console/api/system-features endpoint to identify unusual patterns or high volumes of requests originating from unauthorized external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /console/api/ system-features endpoint to authorized internal network segments or trusted IP ranges.

Public Exploit Available: No — exploit_available is unknown.

Given the high CVSS score, organizations should prioritize updating their Dify instances to the latest available version. Even if the data exposed is deemed non-sensitive by the vendor, removing unnecessary unauthenticated endpoints is a fundamental security practice that reduces the overall attack surface and prevents potential secondary reconnaissance activities.