CVE-2026-41949
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint to extract sensitive content from documents without ownership or workspace permission verification.
Risk Assessment
This vulnerability poses a significant risk to organizations as it allows unauthorized access to sensitive information in documents, potentially leading to data leaks. Additionally, the ease of account creation by unauthenticated users increases the risk of attacks.
Recommendation
It is recommended to update Dify to version 1.14.2 or later to mitigate this vulnerability. Consider implementing additional security measures, such as user identity verification before granting access to sensitive data.
Other vulnerabilities in Dify
See all- CVE-2026-41948Critical
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API. Attackers can exploit insufficient URL path sanitization to access internal endpoints.
- CVE-2026-41947Critical
Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. This vulnerability allows attackers to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers.
- CVE-2025-56157Critical
Dify up to version 1.5.1 includes default PostgreSQL credentials (username and password) in its docker-compose.yaml file. The vendor reports that PostgreSQL is not exposed on TCP port 5432 by default since version 1.0.1.
- CVE-2025-63388Critical
CORS misconfiguration vulnerability in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: The supplier disputes this, arguing that credentialed requests do not provide additional access compared to unauthenticated requests.
- CVE-2026-18632Medium
A security flaw in langgenius dify up to 1.14.2, affecting the jinja2.Template function in api/core/helper/code_executor/jinja2/jinja2_transformer.py of the Jinja2 Handler component, results in improper neutralization of special elements used in a template engine. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-18266Medium
An Open Redirect vulnerability in Dify AI Workflow's AppInitializer component. An attacker can redirect a user to a malicious site during OAuth flow, requiring user interaction (visiting a malicious page or file).
- CVE-2026-61461High
A SQL injection vulnerability in Dify before version 1.16.0-rc1 in the MyScale vector store backend allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
- CVE-2026-41950Medium
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the chat-messages request.
Original NVD description (English source)
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents without ownership or workspace permission verification. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.