Which versions of Dify are affected by CVE-2026-41949?

Dify versions 1.14.1 and prior contain a cross-tenant file disclosure vulnerability allowing any authenticated user to read uploaded documents across all tenants and workspaces.. A patch is available.

Is there a public PoC exploit available for CVE-2026-41949?

Yes, a public proof-of-concept exploit is available for CVE-2026-41949. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-41949?

24 hours: Identify all Dify instances and their versions; implement IP-based or authentication-layer restrictions on /console/api/files/{file_id}/preview endpoint. 7 days: Apply vendor security patch to all Dify instances (versions 1.14.2 and later). 30 days: Review access logs for suspicious file preview activity; audit which files were accessible and notify affected data owners of potential exposure.

Dify CVE-2026-41949

Q: What is the CVSS score of CVE-2026-41949?

CVE-2026-41949 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30774 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-18 VulnCheck

GHSA-jv3f-qwf9-wvq9

Authentication Bypass Dify

8.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 18, 2026 - 15:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 18, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

May 18, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

May 18, 2026 - 15:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

Source Code Evidence Fetched

May 18, 2026 - 15:01 vuln.today

Analysis Generated

May 18, 2026 - 15:01 vuln.today

DescriptionCVE.org

Dify version 1.14.1 and prior contain an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents without ownership or workspace permission verification. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

AnalysisAI

Cross-tenant document disclosure in Dify 1.14.1 and prior allows any authenticated user to read up to 3,000 characters of arbitrary uploaded files across all tenants and workspaces by submitting the file's UUID to the /console/api/files/{file_id}/preview endpoint. The flaw is amplified on Dify Cloud, where free self-registration makes account creation trivial, and publicly available exploit code exists via the Huntr disclosure. No CISA KEV listing has been recorded at time of analysis, but the combination of low-friction account access and a documented PoC raises practical exposure considerably.

Technical ContextAI

Dify is an open-source LLM application development platform (CPE cpe:2.3:a:langgenius:dify) that supports multi-tenant workspaces where users upload documents to power retrieval-augmented generation pipelines. The vulnerability is a classic CWE-639 (Authorization Bypass Through User-Controlled Key): the FilePreviewApi controller in api/controllers/console/files.py called FileService.get_file_preview(file_id) using only the file UUID, and the underlying SQLAlchemy query (select(UploadFile).where(UploadFile.id file_id)) never constrained results to the requesting account's tenant. The upstream patch in PR #35797 introduces current_account_with_tenant() in the controller and adds UploadFile.tenant_id tenant_id to the WHERE clause, enforcing the missing tenant scoping check.

RemediationAI

Upstream fix available via GitHub PR https://github.com/langgenius/dify/pull/35797, which adds tenant scoping to FileService.get_file_preview; upgrade to the first released Dify version that includes this PR (a released patched version greater than 1.14.1 is not independently confirmed from the provided data, so verify the release tag against the PR merge commit before deploying). As an interim compensating control on self-hosted deployments, restrict network access to the /console/api/files/{file_id}/preview endpoint at the reverse proxy or WAF layer to trusted operator IPs, accepting that this will break legitimate in-product file previews for end users. Operators of Dify Cloud-style multi-tenant instances should additionally disable open self-registration if business policy permits, since unauthenticated signup is what converts this from an authenticated-user issue into a near-anonymous one. Review application logs for prior GETs to /console/api/files/*/preview and correlate file_id values against the uploading tenant to detect possible historical abuse.