CVE-2026-41949highCWE-639

CVE-2026-41949: fallo de gravedad alta en langgenius dify

Dify < 1.14.2 Authorization Bypass via File Preview Endpoint

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear dify

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 8.2epss 0.4%
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents without ownership or workspace permission verification. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
langgenius · dify
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — langgenius dify

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-41948CRITICALDify v1.14.1 Path Traversal via Plugin Daemon Internal API AccessEPSS 22.7%CVE-2025-58747LOWDify MCP OAuth Flow Vulnerable to XSSEPSS 6.0%CVE-2026-41947CRITICALDify < 1.14.2 Authorization Bypass via Trace Configuration EndpointsEPSS 6.0%CVE-2026-28288MEDIUMDify has a user enumeration issueEPSS 0.7%CVE-2026-85021MEDIUMlanggenius dify Splash Layout splash.tsx router.replace cross site scriptingEPSS 0.5%CVE-2026-61461HIGHDify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_textEPSS 0.5%