Dashboard / CVE-2026-41947

CVE-2026-41947

CRITICAL
INFO Priority: 0.56 BB Relevance: 80/100
Published: 2026-05-18 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: High
VA: None

Description

Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks in the trace configuration endpoints to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
langgenius dify 0 < 1.14.2

References & Advisories (6)

Bug Bounty Relevance

80 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

5.97%
Raw Score 0.059680
Percentile 93.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.05968
2026-11-12
0.05968
2026-11-10
0.05968
2026-11-09
0.05968
2026-11-08
0.05968

Intelligence Sources

mitre ref →

External Links