{
 "id": "AIR-2025-0027",
 "slug": "cve-2025-59422-broken-access-control-vulnerability-in-dify-e",
 "title": "CVE-2025-59422: Broken access control vulnerability in Dify exposes chat messages",
 "summary": "A broken access control flaw in Dify version 1.8.1 allowed users in the same workspace to read other users' chat messages via specific endpoints. The issue has been addressed and patched in version 1.9.0.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "data_leak"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Dify"
 ],
 "incident_date": "2025-09-25",
 "incident_date_precision": "day",
 "first_reported": "2025-09-25",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59422",
   "publisher": "NVD",
   "title": "CVE-2025-59422: Dify is an open-source LLM app development platform.",
   "published_at": "2025-09-25"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2025-59422",
  "broken-access-control",
  "dify"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}