Block cipher mode with diffusion on ciphertext As I understand, diffusion property in AES-CBC ensures that one-bit change in plaintext will yield changes in all following blocks in ciphertext upon encryption. 

I'm looking for algorithm that will have this property on ciphertext. I.e. when I change one bit in ciphertext, then plaintext after decryption will be changed in all following blocks. As far as I know, AES-CBC changes only two blocks upon decryption.

Does such a mode of operation exist? Or do I have false assumptions?
Yes, there are modes of operation that achieve the property that you are describing. For example, the Propagating Cipher Block Chaining (PCBC) mode of operation:




This mode is similar to CBC but the output for each block is propagated to the input of the next one, so a small error will propagate indefinitely, both for encryption and decryption.

There may exist other less known modes of operation that also share this property.

Depending if you consider also corruption of the Initialization Vector (IV), then other common modes of operation will do. For instance, the Counter (CTR) mode and the Output Feedback (OFB) mode will irremissibly corrupt all the plaintext blocks during decryption if the IV is changed.