Dify CVE-2026-41950

Exploitation requires the attacker to (1) possess valid, authenticated credentials for at least one user account within the target Dify tenant workspace (authentication cannot be bypassed, only authorization can); (2) know or be able to enumerate file UUIDs belonging to other users within the same workspace; (3) the target files must be referenced in or compatible with chat-messages workflow processing (files not integrated into chat processing may not be accessible via this vector). The vulnerability does NOT require special configuration - it affects default Dify installations. Non-default mitigations include: (a) disabling file uploads or multi-user workflows (extreme, not practical); (b) enforcing single-user workspaces (negates product utility). The primary limiting factor is the PR:L (authenticated) requirement, meaning the attacker cannot exploit this remotely without first compromising or obtaining a valid user credential. File UUID enumeration may be blocked by an administrator via API rate-limiting or access controls, which could slow but not prevent exploitation if UUIDs are predictable or discoverable through other means.

This vulnerability presents moderate-to-high real-world risk despite the CVSS 6.0 base score. CVSS vector analysis: AV:N (network-exploitable), AC:L (low complexity), PR:L (requires authentication), VC:H (high confidentiality impact) - indicating that while an attacker must first gain or possess valid workspace credentials, the exploitation barrier is low and the data exposure is severe. EPSS and KEV status are not provided in the input data, preventing direct exploitation probability assessment; however, the presence of publicly available exploit code significantly lowers the practical barrier to exploitation. The PR:L requirement limits scope to insider threats (compromised/rogue users, shared accounts, or developers with workspace access) but does not eliminate risk in organizational environments with high user churn, shared accounts, or weak access revocation practices. The AT:P (Attacker Time) and SC:N (Scope unchanged) modifiers suggest this is a targeted information disclosure, not a denial-of-service or privilege escalation. Risk is elevated in deployments where sensitive documents (contracts, health records, financial data, AI training data) are stored and shared within multi-user workspaces. Organizations with strict data segmentation requirements or regulatory obligations (HIPAA, GDPR) should treat this as high priority. The absence of CVSS scope change (SC:N) and SSVC data means defenders must apply business context: in healthcare or financial services, this is critical; in public collaboration platforms, it remains moderate. No conflicting signals detected between vector and description.

A rogue employee with valid workspace credentials authenticates to Dify and intercepts or infers file UUIDs belonging to colleagues through UI inspection or error messages. The attacker crafts a chat-messages API request with those UUIDs in the files array parameter, sending the request to the platform. The application processes the request without verifying ownership, allowing the attacker to read and exfiltrate sensitive files (contracts, customer data, model training datasets) uploaded by other users. Publicly available exploit code on Huntr demonstrates this attack path.