https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:56:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-105761 <p>Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/&amp;lt;app_id&amp;gt;/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application&#39;s MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.</p> <p>Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/&amp;lt;app_id&amp;gt;/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application&#39;s MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-105761