CVE-2026-41949

🗓️ 18 May 2026 13:52:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 8 Views🌐 WEB

Dify 1.14.1 and earlier allow any authenticated user to read 3000 chars of any uploaded document via file UUID in the preview endpoint, bypassing permissions.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-41949	18 May 202613:52	–	attackerkb
Circl	CVE-2026-41949	18 May 202617:01	–	circl
CNNVD	dify 安全漏洞	18 May 202600:00	–	cnnvd
Cvelist	CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint	18 May 202613:52	–	cvelist
EUVD	EUVD-2026-30774	18 May 202613:52	–	euvd
NVD	CVE-2026-41949	18 May 202615:16	–	nvd
Positive Technologies	PT-2026-41676	18 May 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-41949 Dify v1.14.1 Authorization Bypass via File Preview Endpoint	18 May 202613:52	–	vulnrichment

NVD

Vulners

Node

dify difyRange≤1.14.1

[
  {
    "defaultStatus": "affected",
    "vendor": "langgenius",
    "product": "dify",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "1.14.2"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/dify-authorization-bypass-via-file-preview-endpoint
github	www.github.com/langgenius/dify/releases/tag/1.14.2
huntr	www.huntr.com/bounties/d50a0240-7951-4939-b989-9bded66c7682
github	www.github.com/langgenius/dify/commit/432a6412a3fdb30ce48003d699b90cc7d890df20
github	www.github.com/langgenius/dify/pull/35797

Parameter	Position	Path	Description	CWE
file_id	path	/console/api/files/{file_id}/preview	Authorization bypass on the preview endpoint allowing any authenticated user to read content from uploaded documents using the file UUID across tenants/workspaces.	CWE-639

26 May 2026 17:16Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.9 - 7.5

CVSS 48.2

EPSS0.0004

SSVC

CWE-639