CVE-2025-63387

Disputed Dify bootstrap configuration exposure

LangGenius · Dify Console system-features API

First documented disclosure · Review checkpoint

Summary

A published CVE challenges unauthenticated bootstrap data; the maintainer disputes that it exposes sensitive information.

Severity and exploitation evidence

Medium · 4.3/10 · CVSS 3.1. Severity source.

Exploitation not established: Malicious exploitation is not established by the reviewed primary sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The system-features endpoint returns configuration before login so the dashboard can initialize.

Conditions required

Network access to the Console endpoint; its unauthenticated behavior is intentional according to the maintainer.

Potential impact

The researcher alleges configuration disclosure. The maintainer says no personal data, credentials or secrets are returned; sensitive-data compromise is not established.

Affected versions and configurations

CNA lists 1.9.1 and 1.17.0; these are disputed findings, not a verified continuous affected range.

Fix and mitigation status

No vulnerability-fix release established. PR 31392 merged January 23 as data minimization while preserving unauthenticated bootstrap access.

Practical next steps

Review the exact fields exposed by your deployment and apply supported upstream hardening. Do not add blanket authentication that breaks dashboard initialization solely on this disputed report.

Operating lesson

Validate the sensitivity and purpose of exposed data before treating an open endpoint as an authentication bypass.

Evidence and limits

Original CVE publication was December 18, 2025; November 2 is a record update. The CNA marks the finding disputed. Its 4.3 vector uses low privileges despite the unauthenticated description; older CISA enrichment scores 7.5. Neither score resolves the maintainer’s dispute.

Sources