CVE-2026-41949

🗓️ 18 May 2026 13:52:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

Dify 1.14.1 and earlier allow any authenticated user to read 3000 chars of any uploaded document via file UUID in the preview endpoint, bypassing permissions.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-41949	18 May 202613:52	–	attackerkb
Circl	CVE-2026-41949	18 May 202617:01	–	circl
CNNVD	dify 安全漏洞	18 May 202600:00	–	cnnvd
Cvelist	CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint	18 May 202613:52	–	cvelist
EUVD	EUVD-2026-30774	18 May 202613:52	–	euvd
Mend	CVE-2026-41949	18 May 202613:52	–	mend
NVD	CVE-2026-41949	18 May 202615:16	–	nvd
Positive Technologies	PT-2026-41676	18 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-41949: Authorization Bypass Through User-Controlled Key	18 May 202600:00	–	rapid7
The Hacker News	Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants	22 Jun 202616:13	–	thn

NVD

Vulners

CNA

Node

dify difyRange≤1.14.1

[
  {
    "defaultStatus": "affected",
    "vendor": "langgenius",
    "product": "dify",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "1.14.2"
      }
    ]
  }
]

Source	Link
github	www.github.com/langgenius/dify/releases/tag/1.14.2
zafran	www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps
vulncheck	www.vulncheck.com/advisories/dify-authorization-bypass-via-file-preview-endpoint
github	www.github.com/langgenius/dify/pull/35797
github	www.github.com/langgenius/dify/commit/432a6412a3fdb30ce48003d699b90cc7d890df20
huntr	www.huntr.com/bounties/d50a0240-7951-4939-b989-9bded66c7682

Parameter	Position	Path	Description	CWE
file_id	path	/console/api/files/{file_id}/preview	Authorization bypass allows reading up to 3,000 characters of any uploaded document via the file preview endpoint using only the file UUID, without ownership or workspace permission checks.	CWE-639

14 Jul 2026 20:01Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.9 - 7.5

CVSS 48.2

EPSS0.00566

SSVC

CWE-639