CVE-2026-41949

🗓️ 18 May 2026 13:52:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 41 Views🌐 WEB

Dify 1.14.1 and earlier allow any authenticated user to read 3000 chars of any uploaded document via file UUID in the preview endpoint, bypassing permissions.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-41949	18 May 202613:52	–	attackerkb
Circl	CVE-2026-41949	18 May 202617:01	–	circl
CNNVD	dify 安全漏洞	18 May 202600:00	–	cnnvd
Cvelist	CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint	18 May 202613:52	–	cvelist
EUVD	EUVD-2026-30774	18 May 202613:52	–	euvd
NVD	CVE-2026-41949	18 May 202615:16	–	nvd
Positive Technologies	PT-2026-41676	18 May 202600:00	–	ptsecurity
The Hacker News	Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants	22 Jun 202616:13	–	thn
Vulnrichment	CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint	18 May 202613:52	–	vulnrichment

NVD

Vulners

CNA

Node

dify difyRange≤1.14.1

[
  {
    "defaultStatus": "affected",
    "vendor": "langgenius",
    "product": "dify",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "1.14.2"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/d50a0240-7951-4939-b989-9bded66c7682
github	www.github.com/langgenius/dify/pull/35797
github	www.github.com/langgenius/dify/releases/tag/1.14.2
vulncheck	www.vulncheck.com/advisories/dify-authorization-bypass-via-file-preview-endpoint
github	www.github.com/langgenius/dify/commit/432a6412a3fdb30ce48003d699b90cc7d890df20
zafran	www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps

Parameter	Position	Path	Description	CWE
file_id	path	console/api/files/{file_id}/preview	Authorization bypass allows any authenticated user to read up to 3,000 characters of any uploaded document across tenants/workspaces via the /console/api/files/{file_id}/preview endpoint using a file UUID.	CWE-639

14 Jul 2026 20:01Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.9 - 7.5

CVSS 48.2

EPSS0.00435

SSVC

CWE-639