CVE-2026-41949

creationtimestamp| type| source ---|---|--- 2026-05-18 17:01:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm5e4ahjr62h 2026-07-13 13:00:07+00:00| seen| https://t.me/truesecator/8341 2026-07-14 00:00:44+00:00| seen| https://t.me/truesecator/8341...

CVE-2026-41949

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the...